Command library / john

Crack password hashes offline

Takes a file of password hashes and tries to recover the plaintext behind them — usually by trying every word in a wordlist (--wordlist=file). --format tells john what kind of hash it's looking at when it can't auto-detect it, and --show prints whatever has already been cracked without starting a new run.

Usage

Options and flags

• hashfile

  the file containing the password hashes to crack

• --wordlist FILE

  dictionary file to try passwords from

• --format TYPE

  the hash type, when john can't auto-detect it (e.g. md5, sha256)

• --show

  print passwords already cracked in a previous run, without cracking again

Examples

• john --wordlist=rockyou.txt hashes.txt

  Classic dictionary attack against a hash file using the rockyou wordlist.

• john --format=md5 --wordlist=rockyou.txt hashes.txt

  Same attack, but the hash format is specified explicitly instead of auto-detected.

• john --show hashes.txt

  See what's already been cracked from an earlier run, instantly.

Common mistakes

Related commands