Password Cracking Guide 2026: Hashcat, John the Ripper, and Techniques

Password cracking is the process of recovering plaintext passwords from stored hashes. It's a core skill in penetration testing — after dumping a hash database, cracking it means you can authenticate as those users, escalate privileges, and move laterally across the environment.

This guide covers everything from basic wordlist attacks to advanced GPU-accelerated techniques.

Understanding Password Storage

Passwords are never stored in plaintext (in any properly configured system). They're stored as hashes — the output of a one-way function. To verify a login, the system hashes the input and compares it to the stored hash.

Common hash types:

Hash Type	Example	Speed on GPU
MD5	5f4dcc3b5aa765d61d8327deb882cf99	~50 billion/sec
SHA-1	5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8	~20 billion/sec
SHA-256	6b3a55e0261b0304143f805a24924d0c1c44524821305f31d9277843b8a10f4e	~10 billion/sec
NTLM	8846f7eaee8fb117ad06bdd830b7586c	~100 billion/sec
bcrypt	$2y$12$...	~100/sec
Argon2	$argon2id$...	~10/sec

The algorithm matters enormously. MD5 and NTLM are fast — weak. bcrypt, scrypt, and Argon2 are deliberately slow — they're designed to make cracking infeasible.

Step 1: Identify the Hash

Before cracking, you need to know what you're cracking.

# hashid identifies hash types
hashid '5f4dcc3b5aa765d61d8327deb882cf99'
# Output: [+] MD5 [+] MD4 [+] Double MD5 ...

# hash-identifier (alternative)
hash-identifier '5f4dcc3b5aa765d61d8327deb882cf99'

# Hashcat example hashes (online reference)
# hashcat.net/wiki/doku.php?id=example_hashes

Key identifiers:

• $2y$ or $2b$ — bcrypt
• $6$ — SHA-512 crypt (Linux /etc/shadow)
• $5$ — SHA-256 crypt
• 32 hex chars — likely MD5 or NTLM
• 40 hex chars — SHA-1
• PBKDF2-SHA256 — Django passwords

Step 2: Get a Wordlist

The most important tool isn't the cracker — it's the wordlist.

RockYou (Standard Starting Point)

# Already on Kali:
gunzip /usr/share/wordlists/rockyou.txt.gz
ls -lh /usr/share/wordlists/rockyou.txt  # 133MB, 14.3M passwords

Larger Wordlists

• SecLists — massive collection of security wordlists: apt install seclists
• CrackStation — 1.5 billion entries (15GB) — for serious cracking
• Probable Wordlists — generated from breached datasets

Custom Wordlists

If you know things about the target (company name, birth year, pet names from their LinkedIn), generate a custom list:

# CeWL — scrapes a website and generates a wordlist from the content
cewl https://target.com -d 2 -m 5 -w target_wordlist.txt

# CUPP — interactive tool asking about the target person
cupp -i

Hashcat: GPU-Accelerated Cracking

Hashcat is the most powerful password cracker. It runs on GPU, which can be 1000x faster than CPU for most hash types.

Basic Syntax

hashcat -m <hash_mode> -a <attack_mode> <hash_file> <wordlist>

Hash Modes (Common)

Mode	Hash Type
0	MD5
100	SHA-1
1400	SHA-256
1000	NTLM
3200	bcrypt
500	md5crypt (Linux MD5)
1800	sha512crypt (Linux SHA-512)
13100	Kerberos 5 TGS-REP (Kerberoasting)
18200	Kerberos 5 AS-REP (AS-REP Roasting)
22000	WPA2 (Wi-Fi)

Attack Mode 0: Dictionary Attack (Most Common)

# Crack MD5 hashes using RockYou
hashcat -m 0 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt

# Add status updates every 10 seconds
hashcat -m 0 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt --status --status-timer 10

# Show cracked passwords
hashcat -m 0 hashes.txt --show

Attack Mode 0 + Rules: Dictionary + Transformations

Rules apply mutations to wordlist entries — capitalising, adding numbers, l33t substitutions. This dramatically increases coverage without the storage cost of pre-generating all variants.

# Use best64 rules (64 most effective rules)
hashcat -m 0 -a 0 hashes.txt rockyou.txt -r /usr/share/hashcat/rules/best64.rule

# Use OneRule (community's best single-rule file)
hashcat -m 0 -a 0 hashes.txt rockyou.txt -r OneRule.rule

# Stack multiple rule files
hashcat -m 0 -a 0 hashes.txt rockyou.txt -r best64.rule -r toggles1.rule

Common transformations rules apply:

• password → Password, PASSWORD, Password123, p@ssword, p4ssw0rd
• summer → Summer2026!, Summer26, summer2026

Attack Mode 3: Brute Force / Mask Attack

When you know the password structure (e.g., "8 characters, all lowercase + 2 digits"), masks are far more efficient than pure brute force.

Mask characters:

• ?l = lowercase (a-z)
• ?u = uppercase (A-Z)
• ?d = digit (0-9)
• ?s = special (!@#$...)
• ?a = all of the above

# All 6-character lowercase passwords
hashcat -m 0 -a 3 hashes.txt ?l?l?l?l?l?l

# 8-char: capital + 6 lower + 2 digits (common corporate pattern)
hashcat -m 0 -a 3 hashes.txt ?u?l?l?l?l?l?d?d

# Common patterns: Word + Year + Symbol
hashcat -m 0 -a 3 hashes.txt ?u?l?l?l?l?l?l2?d?d?d?s

# Increment mode (tries all lengths up to max)
hashcat -m 0 -a 3 hashes.txt ?l?l?l?l?l?l?l?l --increment --increment-min 4

Attack Mode 6: Hybrid (Wordlist + Mask)

Append a mask to each wordlist entry:

# Every rockyou entry + 2 digits (catches "password23", "summer09")
hashcat -m 0 -a 6 hashes.txt rockyou.txt ?d?d

# Every rockyou entry + 4 digits (catches "password2026")
hashcat -m 0 -a 6 hashes.txt rockyou.txt ?d?d?d?d

Practical Cracking Workflow

# Step 1: Quick wins — dictionary attack with RockYou
hashcat -m 1000 -a 0 ntlm_hashes.txt rockyou.txt

# Step 2: Apply rules
hashcat -m 1000 -a 0 ntlm_hashes.txt rockyou.txt -r best64.rule -r toggles1.rule

# Step 3: Hybrid — wordlist + year
hashcat -m 1000 -a 6 ntlm_hashes.txt rockyou.txt ?d?d?d?d

# Step 4: Targeted masks based on corporate password policies
hashcat -m 1000 -a 3 ntlm_hashes.txt ?u?l?l?l?l?l?d?d?s

# Step 5: Large wordlists
hashcat -m 1000 -a 0 ntlm_hashes.txt crackstation.txt

John the Ripper: CPU-Based Cracking

John is slower but simpler to use and handles more formats automatically.

# Basic dictionary attack
john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt

# Show cracked passwords
john hashes.txt --show

# John auto-detects format for many hash types
# Force format:
john --format=raw-md5 --wordlist=rockyou.txt hashes.txt
john --format=bcrypt --wordlist=rockyou.txt hashes.txt

# Incremental (brute force) mode
john --incremental hashes.txt

# Apply rules
john --wordlist=rockyou.txt --rules hashes.txt

# Convert Windows SAM/NTDS to john format
python3 secretsdump.py ... > dump.txt
john --format=nt dump.txt --wordlist=rockyou.txt

Common John Formats

john --list=formats | grep -i md5
john --list=formats | grep -i bcrypt

Cracking Specific Hash Types

Linux /etc/shadow

# Format: $id$salt$hash where id = 6 (SHA-512) or 5 (SHA-256)
# Extract with: sudo cat /etc/shadow

# Unshadow combines passwd + shadow
unshadow /etc/passwd /etc/shadow > combined.txt
john combined.txt --wordlist=rockyou.txt

Windows NTLM (from Mimikatz or secretsdump)

# NTLM format: username:uid:LM_hash:NTLM_hash:::
# Extract just NTLM hashes
cut -d: -f4 dump.txt > ntlm_hashes.txt
hashcat -m 1000 ntlm_hashes.txt rockyou.txt

Kerberoasting Hashes

# After running GetUserSPNs.py:
hashcat -m 13100 kerberoast_hashes.txt rockyou.txt -r best64.rule

WPA2 Wi-Fi Handshakes

# Capture handshake with aircrack-ng, then:
hashcat -m 22000 handshake.hccapx rockyou.txt

Defence Against Password Cracking

Use strong hashing algorithms: bcrypt (cost factor 12+), Argon2id, or scrypt for any stored passwords. MD5, SHA-1, and unsalted SHA-256 are too fast — they're defeated by GPU cracking.

Salt every hash: A unique random salt per password ensures rainbow tables are useless and identical passwords produce different hashes.

Enforce password complexity: Minimum 12 characters, passphrases or random strings. Character class requirements are less important than length.

Use a password manager: The reason people use password123 is because they can't remember complex passwords. Password managers eliminate this tradeoff.

Monitor for credential stuffing: If password hashes are leaked, notify affected users immediately and force password resets. Monitor HaveIBeenPwned API for your domain.

Password cracking is covered in the eJPT, OSCP, and CEH certifications. Practise these techniques legally on your home lab or on platforms like HackTheBox and TryHackMe.