CLI · Security Tooling · Go

Build wordlists from people, not guesses.

Feed Valence a personal profile — names, dates, pets, hobbies — and get a deduplicated wordlist that mirrors how real people create passwords. Built for authorized audits and contracted pentests.

$ brew install valence
Star on GitHub Releases ↗
valence
$
What it does

Eight mutation layers.
One deduplicated wordlist.

Valence is a free, open-source wordlist generator for penetration testers and security researchers. Unlike generic wordlists, it builds targeted password candidates from a personal profile — applying leet-speak substitutions, case mutations, date derivations, and pairwise combinations the same way a real person would. Pipe the output directly into Hashcat, John the Ripper, or any password auditing tool.

01

Case + Leet

All 2ⁿ per-character toggle combinations. 1–3 rule leet substitutions: a→@/4, e→3, i→1/!, o→0, s→$/5.

02

Prefix & Suffix

Every token gets bare, suffixed, prefixed, and wrapped forms — !john, john123, !john123 — across the full mutation set.

03

Date & Phone Derivation

Birthdates expand to YYYY, YY, DDMM, MMDD. Phone numbers yield last-4, last-6, area code, and full digits.

04

Pairwise Combination

Every token pair joined with each separator in both orderings — john_smith, smith_john, john.smith — then mutated and suffixed.

05

Common-Word Mixing

Profile tokens paired with real breach-corpus words: johnlove, dragonsmith, ilovejohn. Words never pair with each other.

06

Reversals & Initials

Reversed spellings (nhoj, htims) and initials combos (JSmith, JohnS) derived automatically from name fields.

07

Zero Dependencies

Pure Go standard library. No go get, no supply-chain risk. Auditable, embeddable, cross-compiles to any platform.

08

Pipeline Native

Candidates to stdout, metadata to stderr. Pipes directly into hashcat, sort, uniq. Importable as a Go library.

Installation

Pick your method.

All four produce the same binary. No runtime required.

Homebrew recommended 
$ brew tap g4m3m4g/tap
$ brew install valence

macOS and Linux. Kept up-to-date with brew upgrade.

curl 
$ curl -fsSL https://raw.githubusercontent.com/g4m3m4g/Valence/main/scripts/install.sh | sh

Downloads the correct pre-built binary for your OS and architecture. Installs to /usr/local/bin.

Go install 
$ go install github.com/g4m3m4g/valence@latest

Requires Go 1.22+. Binary lands in $GOPATH/bin.

Build from source 
$ git clone https://github.com/g4m3m4g/Valence.git
$ cd Valence
$ go build -o valence .
Usage

Three ways to run it.

Interactive mode

$ valence

Valence — interactive profile builder
Leave any field blank to skip it.

  First name:                John
  Last name:                 Smith
  Pet's name:                Max
  Date of birth (YYYY-MM-DD): 1990-05-15
  Output file [john_smith.txt]:

No flag memorization required. Valence walks you through each field.

Flag mode

$ valence -first John -last Smith -nick Johnny \
        -partner Sarah -pet Max -child Emma \
        -phone "555-123-4567" -city Bangkok \
        -username j0hn -birthdate 1990-05-15 \
        -o john_smith.txt

Pipe into other tools

# Pipe directly into Hashcat
$ valence -first John -pet Max | hashcat -a 0 -m 1000 hashes.txt

# Filter and sort
$ valence -first John -birthdate 1990-05-15 | sort -u > candidates.txt

Candidates go to stdout. Metadata and errors go to stderr — the split is intentional.

All flags

Profile
-firstFirst name
-lastLast name
-nickNickname or alias
-birthdateDate of birth — YYYY-MM-DD
-partnerPartner or spouse's name
-petPet's name
-childChild's or sibling's name
-favoriteFavorite team, band, or hobby
-numberLucky or favorite number
-cityHometown or current city
-usernameSocial handle or gaming alias
-phonePhone number — non-digits stripped automatically
Output
-oOutput file path — default stdout
-maxCap total candidates — 0 means unlimited
-minlenMinimum candidate length — default 4
-maxlenMaximum candidate length — default 32
Toggles
-no-pairsDisable pairwise token combinations
-no-leetDisable leet-speak substitutions
-no-prefixesDisable prefix prepending
-no-wordsDisable common-word mixing
Internals

How generation works.

Six deterministic stages. Every candidate passes through all of them before landing in the output.

Profile → Tokenize → Mutate → Prefix / Suffix → Pair + Word-mix → Dedup & Filter → Wordlist
Tokenize Each non-empty field becomes a labeled token. Dates expand to YYYY, YY, DDMM, MMDD. Phone numbers to last-4, last-6, area code, and full digits. Initials combos and reversed spellings are derived here.
Mutate Every token gets lowercase, UPPERCASE, Title variants; all 2ⁿ per-character toggle combinations; and leet substitutions in 1-, 2-, and 3-rule combos.
Prefix / Suffix Each mutated form produces four candidates: bare, suffixed, prefixed, and wrapped — john, john123, !john, !john123.
Pair Every distinct token pair joined with each separator in both orderings, then case-mutated and suffixed: john_smith, smith_john, john.smith.
Word-mix Profile tokens paired with breach-corpus words — johnlove, dragonsmith. The full case/prefix/suffix pipeline re-applies. Words never pair with each other.
Dedup & filter map[string]struct{} deduplication in O(1). Length bounds enforced at a single choke point. Results sorted and optionally capped.
Authorized use only

Use it responsibly.

Valence is built for contracted pentests and authorized security awareness campaigns. Every field you supply should belong to a person or organization you have explicit, written authorization to test.

Unauthorized use is illegal. Generating wordlists targeting individuals or organizations without explicit authorization may violate the CFAA (US), Computer Misuse Act (UK), EU Cybercrime Directives, and equivalent statutes worldwide. You bear sole responsibility for legal compliance.