Phase 1: Common passwords (top 1000) - Phase 2: RockYou with rules - Phase 3: Custom MedSecure wordlist with rules - Phase 4: Targeted masks for common patterns - Document percentage cracked at each phase