Mozilla Master Password Recovery Screenshots:
setting Mozilla Master Password recovery options

Quick navigation 1. Selecting Master Password Location 2. Choosing decryption method 3. Setting recovery options     - Dictionary attack options     - Brute-force attack options     - Mask attack options     - Phrase attack options 4. Launching the selected attack back to product's main page

Currently there are 4 decryption methods available:

1. Dictionary attack. Try every word from a dictionary until the password is found. This attack is the most effective.

2. Brute-force attack. Guess the password by trying all probable password variants by given character set.

3. Mask attack. Very helpful if there's any information about the password.

4. Phrase attack. Useful if a part (or source word) of the password is known.

Once selected a recovery type, you will be prompted for different options on the next Wizard page. Let's take a closer look at them.

Dictionary attack options

All options are conditionally split into three groups: dictionary list, password filter, and password mutations.

Dictionary list
In the first group of options, you must set at least one dictionary for the attack. The program comes with big (over 390 000 words) English dictionary.

Password filter
To crop unnecessary passwords, you can use two simple filters. If you have set at least one character in the first 'Include' filter, all passwords that do not contain that character will be ignored (skipped) by the program. The second 'Exclude' filter is totally opposite.

Password mutations
The last group of options manages mutations for each password to be verified. You can set up to three mutation rules: Weak - less number of mutations and, in its turn, greater verification speed; Strong - for greater number of mutations, to the prejudice of the speed, and the happy medium, Normal option. Dictionary attack speed with smart mutations turned on is much slower then the normal mode (without mutations).
For Weak mutations - approximately 25-90 times slower (depending on some system options).
For Normal mutations - ~50-200 times slower.
And for Strong mutations - extremely slow.
P.S. Actual mutation speed depends on many factors and differs for each program release.
 

Brute-force attack options

There are 3 group of options here.

Brute-force charset
Brute-force attack assumes using all possible variations from the specified character range, which is set in the first group of options. You can select and combine predefined character sets (e.g., Latin characters, numbers or special characters) or define your own ones. To define your own character set, select the option 'Custom charset'. The program comes with several examples of user-defined character sets.

Password length and position
The second group of options allows setting the minimum and maximum lengths of the password to be generated. If the last brute-force attack was interrupted or stopped, you can resume it from the last position saved by the program (see 'Starting password' option.)

Distributed attack
This group of options can be useful when you have access to several computers. In this case, the entire set of characters to be verified, if it is too large, can be split into portions and attack the password by portions on several computers at the same time.
 

Mask attack options

The entry field is used for setting the mask (rule), by which the program will try to recover the password. If the mask is set correctly, below you will see the range of characters generated by the mask. The program also allows generating dictionary by mask.

The password mask consists of static (not changing) characters and special sets - dynamically changing letters, numbers or symbols. For example, in the mask 'secret%d(1-100)', the characters 's' 'e' 'c' 'r' 'e' 't' are static, and '%d(1-100)' is the dynamical set. A dynamical set is marked (start) with % character.

Please refer to the program's manual to get more help on mask syntax.
 

Phrase attack options

Phrase attack is an irreplaceable recovery tool when you know a portion of the password or its basic component.

Normally, such cases dispose to using mask attack; however, it does not always allow coping with the task set forth. Suppose our password was 'slwdrvr'. Trying to recover such a complicated password using brute-force attack would be an ungrateful job, even if you are quite sure that it is based upon the 'slowdriver' phrase. These are the cases when the phrase attack will rescue you.

With this tool, the program will attempt to recover the original password, trying all possible combinations founded upon 15 groups of rules (total over 150 rules.) If you enter 'slowdriver' in the field, you will see that the program has generated several thousands of different combinations upon this phrase, and one of those combinations will match our password.

If you remember the original password precisely and simply have forgotten the sequence of the upper-case and lower-case characters in it, you can select the option 'Use only case mutations'. With this option selected, the program will generate passwords with all possible combinations of upper-case and lower-case characters.
 

back to top