Would you do that before or after your dictionary attack? Or brute force character ngrams? Or pure brute random chars? There's a fair few responses pointing out

Would you do that before or after your dictionary attack? Or brute force character ngrams? Or pure brute random chars? There's a fair few responses pointing out that it's not a hugely uncommon ngram, but the known search space in this case is just "a password field", the application/organisation's rules might tell us min length, or if we can discount no numbers/symbols. Time between events should be limited by either the app's login function or a suitably expensive hashing function (whose algorithm will have to be known in the case of a DB dump)