I'm afraid of myself that i was not aware of this one...https://github.com/iphelix/pack
A nine-character password given 262,155 masks and will take more than one year to crack on a low specs machine
How realistic is it that someone will have 6 symbols and 3 numbers as their password? ?d?s?s?s?s?s?s?d?d?d.
Policy Gen can exclude these unlikely masks.
A realistic selection gives 28,246 masks which will take almost 16-17 Days to crack on the same machine
So the Moral is: BE SMART NOT STRONG