In my post on brute-forcing WPA2 passwords, we used crunch to generate a simple list of 8-digit numbers and piped it straight into aircrack-ng. That works, but crunch can do much more than counting. The real power is in patterns — telling crunch exactly what shape a password takes so you generate only the guesses worth trying. As promised, let me show you how.
Remember: The techniques here are for authorized testing and defensive research only. Test only systems you own or have explicit permission to test. We assume no liability for misuse.
A quick refresher
The basic form is:
crunch <min> <max> [charset] [options]So crunch 8 8 0123456789 makes every 8-digit number. Useful, but if you already know the password looks like something — a word plus four digits, a phone number, a date — generating everything is a waste of time and disk. That's where patterns come in.
The pattern placeholders
The -t option lets you specify a template. Inside it, four characters are special — everything else is treated as a literal:
@— inserts lower-case letters,— inserts upper-case letters%— inserts numbers^— inserts symbols
So a password that's the word pass followed by four digits:
crunch 8 8 -t pass%%%%pass stays fixed and the four % cycle through 0000–9999. The min and max (both 8 here) must match the length of your template.
A real-world example: ISP default passwords
Here in the Philippines a lot of ISP-issued routers use an 11-character default that's basically a mobile number — eleven digits starting with 09. We can model that exactly:
crunch 11 11 -t 09%%%%%%%%%The 09 is literal (those characters aren't placeholders), and the nine % vary. Instead of all 11-digit numbers, you only generate the ~1 billion that fit the real pattern — a huge cut.
Mix letter cases and symbols the same way. A password like Summer2019! — capital, lowercase word, year, symbol:
crunch 11 11 -t ,@@@@@%%%%^That's one upper-case, five lower-case, four numbers, one symbol. Order matters when crunch picks its own character sets: you must list them lower, upper, number, symbol. If you want to skip a set, use a + as a placeholder for it.
Using your own characters and words
You don't have to use crunch's full sets. Pass your own charset before -t:
crunch 8 8 abc123 -t @@@@%%%%For named sets (mixed alpha-numeric, symbols, etc.), point crunch at its charset list:
crunch 8 8 -f /usr/share/crunch/charset.lst mixalpha-numericAnd if you have a handful of likely words — a company name, a pet, a street — crunch can generate every permutation of them with -p:
crunch 1 1 -p coders republic 2019(-p ignores min/max, but crunch still wants the two numbers, so 1 1 is just a placeholder.)
To use one of the special characters (@ , % ^) as a literal in your template, the -l option marks which positions are literal — handy when a password genuinely contains an @.
Handy options
-o file.txt— write the list to a file instead of the screen-s startstring— start partway through (we used this in the brute-force post with-s 70000000)-d— limit repeated characters (e.g.-d 2@allows at most 2 repeated lowercase letters)
Piping straight into aircrack-ng
Big lists eat disk. As we did before, skip the file entirely and feed crunch's output directly to aircrack-ng with a pipe:
crunch 11 11 -t 09%%%%%%%%% | aircrack-ng -w - -b AA:BB:CC:DD:00:11 capture-01.capThe -w - tells aircrack-ng to read the wordlist from standard input. No giant file, no wasted space — crunch feeds guesses and aircrack-ng tests them on the fly. (Need the capture-01.cap? See how to capture a WPA2 handshake.)
The takeaway
Brute force isn't really about trying everything — it's about trying the right things first. The better you can describe the password's shape, the smaller and smarter your list, and the faster you get a result. And from the defender's side, this is exactly why predictable passwords (a word + a year, a phone number, the default off the sticker) fall so quickly — and why length plus randomness, or moving to WPA3, matters.
If you found this useful, subscribe to our RSS Feed and YouTube Channel. More writeups are on the way.