John the Ripper — Hash Cracker GuideStep-by-step John the Ripper reference: crack lab password hashes with wordlists and rules. Educational use only.FAQ

What is John the Ripper?

John the Ripper (John) is the classic CPU password-hash cracker: feed it a hash file and a wordlist and it reports which passwords match. Auditors use it to prove that weak hashes fall fast — and that slow modern hashes do not.

Is John illegal?

The tool is legal for audits and recovery. Cracking hashes you do not own or lack permission to test is illegal. Practice on your own lab dumps (DVWA, Metasploitable shadow file).

What does --wordlist do?

--wordlist=rockyou.txt tells John to try every line of that file as the password. Most lab passwords fall here because humans reuse common passwords — the single biggest weakness John exploits.

What are rules (--rules)?

Rules mutate each wordlist entry: add digits, capitalize, append symbols. One base word becomes thousands of guesses, catching real-world patterns like Summer becoming Summer2026!.

What is --show?

--show prints passwords John already cracked from the hash file, so you do not re-crack. Run it first on any file — earlier sessions may have done the work.

How do I crack Linux shadow hashes?

Copy the lab /etc/shadow lines (or unshadow passwd+shadow first), then john --wordlist=rockyou.txt shadow.txt. Lab accounts with weak passwords fall in seconds; strong ones do not.

What is the difference between John and Hashcat?

John runs on CPU and auto-detects many hash formats — easiest start. Hashcat runs on GPU and tries billions per second — fastest finish. Learn the workflow on John, scale to Hashcat.

How do I make my hashes uncrackable?

Store passwords with bcrypt or argon2 (slow, salted), require 12+ random characters via a manager, and add 2FA. Then test with John yourself: an exhausted wordlist with zero cracks is the goal.

All tools · Sitemap · Games