Password Attacks
John the Ripper is a free and open-source password security auditing and password recovery tool. It can crack various password hash types offline and is highly customizable with different attack modes and mangling rules.
sudo apt install john
john [options] <password-file>
John the Ripper (JtR) is a free, open-source password security auditing and password recovery tool. First released in 1996, it has become one of the most versatile and widely-used password crackers in the world.
John excels at automatic hash type detection, making it accessible to beginners. It supports hundreds of hash formats including MD5, SHA, NTLM, bcrypt, DES, and can directly crack passwords from encrypted ZIP, RAR, PDF, and Office documents.
The tool operates entirely offline, making it safe for authorized password auditing without triggering account lockouts. It uses CPU-based cracking with multi-process support for parallelization across multiple cores.
john hashes.txtAuto-detect crack - Launch a quick start cracking session letting John automatically detect the hash typejohn --wordlist=/usr/share/wordlists/rockyou.txt hashes.txtDictionary attack - Use a specific wordlist to test common passwords against the target hashesjohn --show hashes.txtShow cracked - Display the cracked passwords alongside their associated usernames from the sessionjohn --format=raw-md5 hashes.txtSpecify format - Manually set the hash type when the format is already knownjohn --incremental hashes.txtBrute force - Try all possible character combinations in an exhaustive searchjohn --incremental=digits hashes.txtDigits only brute force - Restrict character mutations to numeric patterns for PIN crackingunshadow /etc/passwd /etc/shadow > combined.txtCombine Linux authentication files - Merge system user and shadow files into a format John can readjohn --rules --wordlist=wordlist.txt hashes.txtRules mode - Apply wordlist mangling rules to mutate dictionary words into common variationsjohn --fork=4 --wordlist=wordlist.txt hashes.txtMulti-process execution - Distribute the workload across 4 CPU cores to speed up the cracking processjohn --session=mycrack hashes.txtNamed session - Save the current cracking progress under a specified name for long operationsjohn --restore=mycrackRestore session - Resume an interrupted or paused cracking session from its last saved statejohn --format=nt hashes.txtNTLM hashes - Target Windows SAM database or Active Directory password hashesjohn --format=raw-sha256 hashes.txtSHA256 hashes - Target standard standalone SHA-256 cryptographic check valuesjohn --format=bcrypt hashes.txtbcrypt hashes - Force parsing rules for modern, high-cost adaptive hashing algorithmsjohn --format=zip encrypted.zipZIP password - Attempt to crack password-protected ZIP archive extractions directlyCrack /etc/shadow passwords using unshadow to combine passwd and shadow files.
Recover passwords from extracted Windows SAM database hashes.
Crack passwords from ZIP, RAR, and 7z archives using format-specific modes.
Recover passwords from encrypted PDF and Office documents.
Solve cryptography and password cracking challenges in competitions.
John is pre-installed on Kali Linux. Run 'john hashes.txt' to auto-detect the hash format, or specify with '--format=md5 hashes.txt'. Use '--wordlist=/usr/share/wordlists/rockyou.txt' for dictionary attacks. The community edition (jumbo) supports 200+ hash formats.
First combine passwd and shadow files: 'unshadow /etc/passwd /etc/shadow > hashes.txt'. Then crack with: 'john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt'. This only works on systems you own or have authorization to audit. The unshadow tool is included with John.
John the Ripper is better for CPU-based cracking and obscure hash formats. Hashcat excels with GPU acceleration for common hashes (MD5, SHA-1, NTLM). John supports 200+ formats natively; Hashcat has better performance for supported formats. Many professionals use both.
Run 'john --show hashes.txt' to display all cracked passwords. Use '--format=raw-md5' to specify the hash type. The output shows each hash alongside its plaintext. Combine with '--incremental' to show only newly cracked hashes since last session.
Yes. Use 'pdf2john protected.pdf > hash.txt' then 'john hash.txt' for PDFs. For ZIP files: 'zip2john protected.zip > hash.txt' then crack. John also supports RAR, 7z, Office documents, and KeePass databases via specialized extraction tools.
The default wordlist directory is '/usr/share/wordlists/'. The most commonly used file is 'rockyou.txt' — if it doesn't exist, decompress it: 'sudo gunzip /usr/share/wordlists/rockyou.txt.gz'. You can also use custom wordlists with the --wordlist flag.
Password Attacks
GPU-accelerated password cracker for maximum speed on large hash sets.
Password Attacks
Online brute-force tool for testing cracked passwords against live services.
Password Attacks
Custom wordlist generator for creating targeted dictionaries for John.
Password Attacks
Wordlist generator based on character sets, patterns, and length ranges.
Password Attacks
Online brute-force tool for testing cracked passwords against live services.
The software outputs the recovered cleartext next to the corresponding user identifier. Status prompts indicate the current speed and an estimated completion timeframe.
This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.