# Mentalist, a Tkinter wordlist builder that chains Base Words with Append and Prepend nodes > Mentalist is a Python and Tkinter desktop tool that assembles a custom wordlist out of the way people actually build passwords, then writes the result as a plain wordlist or as rules for Hashcat and John the Ripper. It cracks nothing itself, and several features a production label would claim are still listed as future work. **sc0tfree/mentalist** — Mentalist is a graphical tool for custom wordlist generation. It utilizes common human paradigms for constructing passwords and can output the full wordlist as well as rules compatible with Hashcat and John the Ripper. - Repository: https://github.com/sc0tfree/mentalist - Stars: 2,042 · Forks: 258 - Language: Python - License: MIT - Published: 2026-10-14 · Updated: 2026-10-14 · Language: en - Canonical page: https://hysenlabs.com/projects/sc0tfree-mentalist ## The node chain that turns password habits into a wordlist Mentalist builds one list for one set of habits instead of shipping a generic dictionary. Its own description says it uses common human paradigms for constructing passwords and can output the full wordlist as well as rules compatible with Hashcat and John the Ripper. Nothing in the repository hashes, compares, or cracks anything: the top level holds `pyproject.toml`, `mentalist.spec`, `pyinstaller_stub.py`, `poetry.lock`, `assets/` and `tests/`, all of which serve generation or packaging. The project's own disclaimer limits use to informational purposes or authorized system audits. The pieces of the pipeline are named only inside the Future Work list, which is an odd place to meet them. A Base Words node supplies the raw candidates, Append and Prepend nodes extend every candidate, and the assembly is kept in a Mentalist Chain file. Those three names are the whole vocabulary offered for how a list gets built, so the rest of the interface has to be learned from the wiki rather than from the code. ## Tkinter is the one prerequisite pip cannot install `[tool.poetry.dependencies]` names a single requirement, the interpreter range `python = ">=3.11,<4.0"`, and no runtime libraries at all. Version 2.0 of the package needs Python 3.11 or higher, and anything older belongs to the v1.0 line. The GUI layer is therefore a system concern rather than a package concern: tkinter ships with Python, but the Tcl and Tk libraries underneath it are separate operating system packages, and no pip line can supply them. A `pip install .` can finish cleanly on a host that has neither, and the gap only shows up when a window is asked to open. Homebrew Python on macOS needs the Tk bundle matched to the interpreter version, so 3.13 and 3.12 users pick different lines than 3.11 users: ```bash brew install python-tk@3.13 brew install python-tk@3.12 brew install python-tk@3.11 ``` Debian and Ubuntu take one apt line: ```bash sudo apt-get install python3-tk ``` Fedora and RHEL use dnf for the same job: ```bash sudo dnf install python3-tkinter ``` Windows is the easy case, because Tkinter arrives with the official installer from python.org and needs nothing extra. ## Two documented launch paths end at the same controller main `[tool.poetry.scripts]` maps the console script `mentalist` to `mentalist.controller:main`, so both documented ways of starting the tool land in one function inside a `controller` module. The Poetry route, which the README calls recommended, runs from a fresh clone: ```bash git clone https://github.com/sc0tfree/mentalist.git cd mentalist poetry install poetry run mentalist ``` The pip route reaches the same code through a module path instead of the console script: ```bash pip install . python -m mentalist ``` Both names open 1 graphical start, and nothing else sits at the entry point. No subcommand, no flag, and no non-interactive mode appear anywhere in the install or usage sections, so an automated audit has no supported way to drive this tool. ## Packaged data and icons set the ceiling on the interface The `include` list in `pyproject.toml` names `mentalist/data/*.txt` and `mentalist/data/*.psv` together with `mentalist/icons/*.gif`, `mentalist/icons/*.ico` and `mentalist/icons/*.icns`. Built-in word lists and artwork therefore travel inside the installed package instead of being fetched at run time, and 3 icon formats line up with the 3 desktop platforms the prerequisites cover. The `.psv` extension shows up nowhere except that include list. Nothing in the repository explains what a psv file holds, how it differs from the `.txt` lists sitting beside it, or which node consumes which, so anyone extending the shipped data has to read `mentalist/data/` directly. One bundled list is at least named in prose: `Slang & Expletives`, which the README defends as words that people genuinely use inside credentials. The others are anonymous. ## Offline combinations versus rule mangling inside the crackers The nearest alternative is not another GUI but the rule engine built into Hashcat and John the Ripper, the two tools named as consumers of Mentalist output. Those take a small base list plus a rules file and expand combinations as they work through candidates, so what sits on disk stays tiny and the combinatorics are paid at run time against real hashes. Mentalist reverses that order. It does the expansion first, with no hash anywhere in the process, and writes the finished wordlist or the finished rules out for someone else to consume. That is the actual difference in approach, and it has a practical consequence: a precomputed file can be inspected, reviewed, split, shipped to another machine, and regenerated from the same chain for a different cracker, whereas a run-time rule file stays tiny but is never visible as a whole. One gap decides whether the output is usable. The README documents neither the rule syntax written for Hashcat nor the syntax written for John the Ripper, only that both are compatible, so confirm the format against your own cracker's expectations before committing a long run to it. ## A standalone executable needs PyInstaller added first Building a single binary takes 2 steps, and the first one is not in the project metadata: `[tool.poetry.group.dev.dependencies]` carries pytest at 8.0.0 and nothing else, so PyInstaller has to be pulled in before it can be run. ```bash poetry add --group dev pyinstaller poetry run pyinstaller mentalist.spec ``` The spec file is committed at the top level next to `pyinstaller_stub.py`, and the finished binary lands in the `dist/` directory. This matters because prebuilt executables exist only for the older v1.0 line, which covers Python 3.6 to 3.10, so on 3.11 and above the build belongs to whoever wants the binary, on every platform they care about. ## Five gaps the README still files under future work The open items are 5 specific additions: scraping sites as an attribute in the Base Words node, dictionaries and lists for more languages, UK post codes for the Append and Prepend nodes, de-duplication of Base Words, and Mentalist Chain file differencing. Two of those 5 are not conveniences. Without de-duplication, two base lists that overlap emit the same candidate more than once, and every downstream Append and Prepend node multiplies the duplicates rather than removing them, so a chain that looks small on screen can write a bloated wordlist. Chain file differencing is the missing tool for the question you ask when a saved chain stops finding new hashes: what changed between this chain and the one that worked last month. That list sits next to a contradiction inside `pyproject.toml`, which classifies the package as `Development Status :: 5 - Production/Stable` while 5 features, de-duplication among them, remain unwritten. A stable status badge and an open to-do list cannot both be accurate, and the classifier is the one most tooling displays at a glance. ## Where Mentalist is the wrong tool Three cases stand out. For automation, the install section offers `poetry run mentalist` and `python -m mentalist`, both of which open a Tkinter window, and no headless mode or flag is documented, so a scheduled job has nothing to call. For anything that needs target data, collecting words from a site is still on the future list, so base lists are assembled by hand or imported by hand. For anything outside English, more languages are listed as future work and the postcode list does not yet cover UK codes. The documentation split adds cost. Installation and usage detail is pushed to the wiki, the top level carries no docs directory, node reference, or specification of the Mentalist Chain file, and the code ships under the MIT License with version 2.0.0 recorded in `pyproject.toml`. `poetry.lock` is committed, so dependency resolution is pinned and reproducible, yet a chain file written by an earlier build has no documented migration path. Upgrading the code is cheap; upgrading a saved chain is undefined. ## Conclusion Mentalist fits an auditor who wants one bespoke wordlist for a known set of password habits and is willing to click through a Tkinter window; it does not fit a pipeline that needs a documented, unattended command. Check three things in the wiki first, because the README documents none of them: the Mentalist Chain file format, the node types beyond Base Words and Append and Prepend, and the rule syntax written for Hashcat and John the Ripper. With no de-duplication of Base Words listed, an overlapping chain duplicates candidates, so diff a small chain by hand before scaling it. The last push was on 2026-04-14. ## FAQ ### Does Mentalist need tkinter installed separately on my system? On macOS and Linux, yes, because pip cannot install it. Debian and Ubuntu use `sudo apt-get install python3-tk`, Fedora and RHEL use `sudo dnf install python3-tkinter`, Homebrew Python needs `brew install python-tk@3.13` matched to the interpreter, and the official Windows installer from python.org already includes Tkinter. ### What Python version does Mentalist require? `pyproject.toml` sets the floor at 3.11 with an upper bound below 4.0, and its classifiers name 3.11, 3.12 and 3.13. The prebuilt executables cover Python 3.6 to 3.10 only, so anything newer means installing from source. ### Can Mentalist run without a GUI for an automated audit? No headless or non-interactive mode is documented. Both launch commands, `poetry run mentalist` and `python -m mentalist`, start the Tkinter window, so an unattended job has no supported entry point to call. ### Does Mentalist crack password hashes itself? No. It writes a wordlist and a rules file, and Hashcat and John the Ripper are named as the consumers of that output. The repository contains no hashing or cracking code, and the project's own disclaimer limits use to informational purposes or authorized system audits. ### How do I run the Mentalist test suite? Install with `poetry install` and run `poetry run pytest`. Pytest is pinned to `^8.0.0` in the dev dependency group, and `[tool.pytest.ini_options]` points testpaths at the `tests` directory with a `test_*.py` naming rule. ## Sources - [Issues](https://github.com/sc0tfree/mentalist/issues) - [License: MIT](https://github.com/sc0tfree/mentalist/blob/master/LICENSE) - [README](https://github.com/sc0tfree/mentalist/blob/master/README.md) - [Releases](https://github.com/sc0tfree/mentalist/releases) - [sc0tfree/mentalist on GitHub](https://github.com/sc0tfree/mentalist) --- Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/sc0tfree-mentalist