_ ReconLab
Commands  / Password Attacks  / John the Ripper

John the Ripper

Versatile offline password hash cracker.

KaliParrotLinuxmedium

pkg: john

John the Ripper cracks password hashes offline using wordlists and rules, auto-detecting many hash formats.

Syntax

john [--wordlist=...] {hashfile}

Example

john --wordlist=rockyou.txt hashes.txt

Cracks hashes in the file using the rockyou wordlist; results via `john --show`.

Options & flags

What each switch does. Toggle them in the builder below to assemble a command.

--wordlist <rockyou.txt>Dictionary file to use.
--rules <Jumbo>Apply mangling rules (e.g. Jumbo, Single).
--format <raw-md5>Force the hash format (e.g. raw-md5, sha512crypt, NT).
--incrementalBrute-force (incremental) mode.
--singleSingle-crack mode using GECOS/username hints.
--showShow already-cracked passwords.
--fork <4>Use N processes (CPU parallelism).
--session <job1>Name the session (resume with --restore).

Command builder

Tick options (and fill any values) to build a ready-to-copy command.

john HASHFILE

Usage examples

john --wordlist=rockyou.txt hashes.txt

Dictionary attack on the hash file.

john --format=NT --wordlist=rockyou.txt --rules ntlm.txt

Crack NTLM hashes with mangling rules.

john --show hashes.txt

Display recovered passwords after cracking.

Advantages
  • Auto-detects many formats
  • Powerful rule-based mangling
  • CPU-friendly, scriptable
Disadvantages
  • Slower than GPU hashcat
  • Needs the hashes already
  • Format quirks for some hashes
Tags
#hash-cracking#offline

Official docs: John the Ripper ↗

Related commands

hash-identifier

Guess the algorithm behind a hash.

hashcat

World’s fastest GPU password recovery.

Frequently asked questions

What is John the Ripper used for?
John the Ripper cracks password hashes offline using wordlists and rules, auto-detecting many hash formats.
What is an example John the Ripper command?
A common example is: john --wordlist=rockyou.txt hashes.txt — Cracks hashes in the file using the rockyou wordlist; results via `john --show`.
Is John the Ripper part of Kali Linux?
Yes. John the Ripper ships with Kali Linux (and Parrot OS). If missing, install it with: sudo apt install john.
What category of security tool is John the Ripper?
John the Ripper is a Password Attacks tool with a medium-risk profile when run against a live target.

Try recon tools live

Run real scans against a domain you control, stage by stage.

Open the lab →