# How CUPP Handles Partner and Child Information in Password Generation

> Discover how CUPP generates passwords using partner and child information. Learn how it fragments and combines data for robust family-based password candidates.

- Repository: [Mebus/cupp](https://github.com/Mebus/cupp)
- Tags: how-to-guide
- Published: 2026-07-03

---

**CUPP collects partner and child details—names, nicknames, and birthdates—during interactive profiling, then slices these values into fragments and combines them with the victim's data using the `komb()` function to generate family-based password candidates.**

The Common User Passwords Profiler (CUPP) is an open-source tool in the Mebus/cupp repository designed to create targeted wordlists for password security auditing. When operating in interactive mode, CUPP explicitly requests information about the victim's partner and children to enhance prediction accuracy. Understanding how CUPP handles partner and child information in password generation reveals why family-based passwords like `alice1992` or `john_jr08` appear frequently in generated dictionaries.

## Collecting Partner and Child Data in Interactive Mode

CUPP's `interactive()` function in [`cupp.py`](https://github.com/Mebus/cupp/blob/main/cupp.py) (lines 306-338) prompts the user for six specific fields related to family members. These inputs are normalized to lowercase and stored directly in the profile dictionary alongside the primary victim's data.

For the partner (spouse), CUPP captures:

```python
profile["wife"]   = input("> Partners) name: ").lower()
profile["wifen"]  = input("> Partners) nickname: ").lower()
profile["wifeb"]  = input("> Partners) birthdate (DDMMYYYY): ")

```

For children, the pattern follows similarly:

```python
profile["kid"]    = input("> Child's name: ").lower()
profile["kidn"]   = input("> Child's nickname: ").lower()
profile["kidb"]   = input("> Child's birthdate (DDMMYYYY): ")

```

All six values persist in the same `profile` dictionary that contains the victim's own biographical data, ensuring seamless integration during the generation phase.

## Extracting Date Fragments for Family Members

Inside `generate_wordlist_from_profile()` (lines 403-424), CUPP processes birthdate strings into multiple numeric fragments. This slicing logic applies identically to the victim, partner, and child dates, creating versatile components for password construction.

For the partner's birthdate stored in `profile["wifeb"]`:

```python
wifeb_yy   = profile["wifeb"][-2:]   # Last 2 digits (year)

wifeb_yyy  = profile["wifeb"][-3:]   # Last 3 digits

wifeb_yyyy = profile["wifeb"][-4:]   # Full year

```

The child's birthdate undergoes identical processing:

```python
kidb_yy    = profile["kidb"][-2:]
kidb_yyy   = profile["kidb"][-3:]
kidb_yyyy  = profile["kidb"][-4:]

```

These fragments populate the `wbdss` (partner dates) and `kbdss` (child dates) lists, which later feed into the combination engine alongside month and day extractions.

## Building Name Pools with kombinaw and kombinak

Before generating passwords, CUPP constructs specialized name pools for family members (lines 438-452). The system creates title-cased variants alongside the original lowercase values to account for common capitalization patterns.

The partner name pool (`kombinaw`) includes:

```python
wifeup    = profile["wife"].title()    # "alice" becomes "Alice"

wifenup   = profile["wifen"].title()
surnameup = profile["surname"].title()

kombinaw = [
    profile["wife"],    # lowercase name

    profile["wifen"],   # lowercase nickname

    wifeup,             # title case name

    wifenup,            # title case nickname

    profile["surname"], 
    surnameup,
]

```

The child name pool (`kombinak`) follows an identical structure using `kid`, `kidn`, and their title-cased variants (`kidup`, `kidnup`). These pools ensure that password candidates cover variations like `alice92`, `Alice92`, and `ALICE92`.

## Combining Data with the komb() Function

The final password generation occurs in lines 866-894, where CUPP feeds the family name pools into the `komb()` helper function. This utility concatenates each name element with date fragments, special characters, and numeric suffixes to produce comprehensive candidate lists.

For partner combinations:

```python
kombi[2] = list(komb(kombinaw, wbdss))          # Partner names + partner dates

kombi[2] += list(komb(kombinaw, wbdss, "_"))    # With underscore separator

```

For child combinations:

```python
kombi[3] = list(komb(kombinak, kbdss))          # Child names + child dates

kombi[3] += list(komb(kombinak, kbdss, "_"))    # With underscore separator

```

The `komb()` function systematically joins each element from the name pools (`kombinaw` or `kombinak`) with each element from the corresponding date lists (`wbdss` or `kbdss`). After generation, CUPP deduplicates the results, applies length constraints, optionally applies leet-speak transformations, and writes the final output to the wordlist file.

## Summary

- **CUPP stores family data** in the same `profile` dictionary as the victim's information, using keys `wife`, `wifen`, `wifeb`, `kid`, `kidn`, and `kidb`.
- **Date fragmentation** extracts 2-digit, 3-digit, and 4-digit year components from partner and child birthdates to create flexible numeric suffixes.
- **Name pools** (`kombinaw` and `kombinak`) include both lowercase and title-cased versions of names, nicknames, and surnames to maximize pattern coverage.
- **The `komb()` function** generates final candidates by concatenating family names with their corresponding date fragments, supporting both direct concatenation and underscore-separated formats.
- **Output processing** removes duplicates, enforces length limits, and applies optional leet-speak encoding before saving the family-enhanced password list.

## Frequently Asked Questions

### Does CUPP require partner and child information to generate a wordlist?

No, providing partner and child information is optional during the interactive session. If you skip these fields, CUPP generates passwords based solely on the primary victim's data and generic permutations. However, including family data significantly improves the wordlist's effectiveness against users who incorporate family members' names or birth years into their passwords.

### How does CUPP format dates when combining them with names?

CUPP extracts multiple fragments from the DDMMYYYY birthdate format stored in `profile["wifeb"]` and `profile["kidb"]`. The code slices strings to isolate the last 2 digits of the year (e.g., "92"), the full 4-digit year ("1992"), and typically the day-month combination ("1508"). These fragments are stored in date lists (`wbdss`, `kbdss`) that the `komb()` function iterates through, creating candidates like `alice92`, `alice1992`, and `alice1508`.

### Can CUPP handle multiple children or partners?

The current implementation in [`cupp.py`](https://github.com/Mebus/cupp/blob/main/cupp.py) supports only one partner and one child through the `kid` and `wife` profile keys. The interactive mode does not loop to collect additional family members, and the generation logic specifically references these single-instance keys. Users requiring multiple family member profiles would need to manually edit the source code to add additional profile fields and corresponding combination logic.

### What password patterns does CUPP create with family information?

CUPP generates several pattern types using the `komb()` function: direct concatenation of names and years (e.g., `alice92`), underscore-separated versions (`alice_92`), capitalized variants (`Alice92`), and combinations with the victim's surname. These patterns are then mixed with leet-speak substitutions and numeric suffixes, producing realistic family-based passwords like `johnjr08`, `mary_1995`, or `smithkid22`.