gholamreza Ahmadi

Passwords are still the most important and widely used authentication mechanism in the digital world, but the Verizon DBIR 2024 report shows that 81% of data breaches were caused by weak, repetitive, or guessable passwords. Traditional password strength assessment methods such as zxcvbn, PasswordMeter, and Shannon Entropy Measure focus solely on length, character diversity, and the presence of dictionary words, and fail to understand the linguistic, semantic, and especially cultural patterns of users. In this research, the PersianPassEval framework is proposed; a hybrid model that uses Word2Vec fine-tuned on more than 550 million real leaked passwords, BPE tokenization, a bidirectional BiLSTM network and its combination with 42 statistical and cultural features, and finally classification with Random Forest, is able to classify passwords with very high accuracy into three levels of weak, medium, and strong. The model is trained on three large datasets: RockYou (32.5M), Have I Been Pwned (multilingual section), and especially PersianLeak-1404 (8.3M real Persian passwords collected from breaches in 1403 and 1404). The results show an average improvement of 12% in F1-score, 15% in AUC over zxcvbn, and most importantly, a 22% improvement in F1-score on Persian data. This framework is the first to specifically model Persian cultural patterns such as solar dates, religious and family names, “name + year” combinations, and Persian emotional expressions.