§01 · A grammar machine for authorised research
Enigmista.
Models the structure of an authorised password corpus and generates new, previously-unseen candidates that fit its distribution — for policy audits, honeyword decoys, synthetic data, and research.
enigmista (it.) — one who crafts and solves enigmas
§02 · Structure
It reads the shape of a corpus, never the secrets of a person.
Give it a seed corpus you're authorised to analyse — a population of passwords — and it learns the grammar underneath: the templates people reach for, the slots they fill.
Neural · the language model
Induces the grammar from the seed — names the themes, sorts the slots, and extends the dictionaries with plausible members it was never shown.
Symbolic · sampler & scorer
A deterministic sampler draws candidates in probability order; a scorer checks them against real passwords held out from training. The model proposes; the symbolic layer owns the probability.
§03 · Uses
Three uses. All defensive.
⟨audit⟩ · Password-policy audits
Test a policy you're authorised to audit against the realistic structure of the passwords it governs.
⟨decoy⟩ · Honeywords & decoys
Decoys that fit the corpus's distribution. The more plausible the decoy, the more reliably a login with it signals a breach.
⟨synth⟩ · Synthetic data & research
Password sets with the statistical shape of the real thing — for testing systems and studying how people choose.
§04 · Objective
Predict the passwords you haven't seen.
A model that memorises its seed is worthless — it only regenerates what it was given. Enigmista is judged on a frozen held-out split it never trained on.
The kernel, in geometry
Below the drum lies what it draws from: the toy grammar as a disc of probability. The inner ring splits the circle by template; each ring outward splits its slice by the next slot's terms. A slice's angle is the chance a draw lands in it; the towers on the rim are whole passwords.
Temperature · τ
A sample is a dart thrown at a uniform angle and read outward, ring by ring. τ reshapes the disc: low τ piles the mass onto a few tall modes; high τ flattens the skyline and widens the tails, where the held-out passwords wait.
§05 · Method
A loop that only believes its scorer.
induce → sample → score → analyse misses → refine, until coverage plateaus or hits a target.
01 · Corpus & protocol
Load the authorised seed, deduplicate, freeze an 80/20 train / held-out split — once, never re-split. Markov and PCFG baselines set the number to beat.
02 · Induce
A language model builds the grammar from the training split; on a frontier model, an enrichment pass adds plausible unseen terms.
03 · Sample
Draw a budget of candidates at temperature τ, ordered by probability — the guess order.
04 · Score
The bundled scorer measures coverage of the held-out split. Never self-assessed: no improvement is claimed without its numbers.
05 · Analyse misses & refine
Read the held-out passwords it missed, hypothesise the missing structure, refine the grammar, go round again.
06 · Stop
When coverage beats the best baseline and gains plateau — or the iteration cap is reached.
§06 · Sandbox
Illustrative · toy data
A grammar from sixteen fake passwords.
A tiny inducer, run in your browser on a corpus we invented. Nowhere to type a password, nothing sent
anywhere — it illustrates induce → sample; it is not the engine.
01 · Segment
Each password splits into slots by character class: word, year, digit, symbol.
02 · Count templates
Passwords with the same slot pattern stack together. The stacks are the template probabilities.
03 · Fill slots
Each slot keeps the terms the seed used, weighted by how often. From the seed alone, of the held-out passwords are reachable.
04 · Enrich (scripted here)
Plausible terms the seed never showed are added — in the real loop a frontier model proposes them. Now are reachable — reachable, not yet covered.
05 · Sample
The Rotor draws from the induced grammar — every candidate on the right is one spin. Move τ and sample again.
- 01 · Segment
- 02 · Count templates
- 03 · Fill slots
- 04 · Enrich (scripted)
- 05 · Sample
Toy seed · train split
W word · Wc Word · Y year · D digit · DD two digits · S symbol
Toy held-out · never shown
Induced grammar
+ terms were added by a scripted stand-in for the enrichment pass — in the real loop a frontier model proposes them.
Sampled
Reachable is not covered: after enrichment the grammar can produce every held-out entry, but a handful of draws rarely lands on them. On real corpora the probability ranking decides coverage.
§07 · Scope
The corpus boundary is the whole line.
The same machinery is defensive on a corpus and an attack on a person. Enigmista stays on one side of that line by design.
In scope
Policy audits you're authorised to run. Honeywords and decoys. Synthetic data and research — always from a seed corpus you're authorised to use: a population, never one person.
Out of scope — refused
A person's name, birthday or pet used to guess their passwords. Candidates aimed at someone's accounts. One person's passwords passed off as a corpus.
When asked to cross it
Enigmista names the boundary, offers the legitimate version — model a corpus you're authorised to use —
and stops. Its candidate lists and grammars stay in a local ./out/.
This site
Keeps the same rule: a bundled toy list, nowhere to type a password, no analytics, no trackers.
§08 · Install
Run the real loop.
Enigmista ships as a skill for runtimes with a disk and script execution: Claude Code, Gemini CLI, or a local model on Hermes. It hands back at every checkpoint.
01 · Get & install
unzip enigmista-skill.zip -d ~/.claude/skills/Download the skill Latest GitHub release (v1.0.0) · the release notes cover Claude Code, the Gemini Gem, and checksums.
02 · Smoke-test the scorer
python3 scripts/eval_coverage.py \
--heldout assets/sample/normal/heldout.txt \
--candidates assets/sample/normal/candidates.jsonl \
--train assets/sample/normal/train.txt \
--baseline assets/sample/normal/baseline_coverage.json \
--out /tmp/out.json --cutoffs 5 10 100 --primary 100
SUMMARY: cov@100=75.0% (hit 3/4 held-out) Δbaseline=+25.0pts novelty=57.14% cands=1403 · Bring an authorised corpus
Put your seed in data/seed.txt and start the loop — baselines come back first. Prefer to talk
it through? The Gem on Gemini writes the grammar and commands, but never reports coverage as measured:
enigmista-gem.zip.
Repository on GitHub All releases
Authorised, defensive research · No analytics, no trackers · build —