Crunch is a wordlist and keyspace generator that creates permutations and combinations of characters based on rules you specify — character sets, minimum/maximum length, patterns, and more. Unlike CeWL (which derives words from real-world content) or CUPP (which derives candidates from personal information), Crunch generates every possible combination within a defined character set and length range, making it the tool of choice for true brute-force keyspace generation, such as cracking short numeric PINs, generating all possible license plate formats, or feeding a custom-charset mask attack into Hashcat/John.
Crunch calculates the required disk space before generating output and warns you if the resulting wordlist would be too large for available storage. It supports custom character sets, patterns (using @, ,, %, ^ placeholders for lower, upper, numeric, and symbol characters respectively), and can pipe directly into another tool instead of writing to disk.
Key Features
- Generates exact character permutations for any given min/max length and charset
- Pattern-based generation (
-t) for structured formats (e.g., 3 letters + 4 digits) - Built-in charset file (
/usr/share/crunch/charset.lst) with predefined sets (numeric, alpha, symbols, hex, etc.) - Can split output across multiple files for distributed cracking (
-o START,-c,-p) - Can pipe output directly to stdout for use with other tools without writing to disk
Installation
Crunch is preinstalled on Kali Linux. To install/update manually:
sudo apt update
sudo apt install crunch -y
Verify:
crunch --help
From source:
wget https://sourceforge.net/projects/crunch-wordlist/files/latest/download -O crunch.tgz
tar -xzf crunch.tgz
cd crunch-*
make
sudo make install
Syntax
crunch <min-len> <max-len> [charset] [options]
Command-Line Options
| Option | Description |
|---|---|
min-len | Minimum length of generated strings (required, positional) |
max-len | Maximum length of generated strings (required, positional) |
charset | Character set to use (positional, optional — defaults to lowercase a-z) |
-f FILE SETNAME | Load a named character set from a charset file (e.g., /usr/share/crunch/charset.lst) |
-o FILE | Output to FILE instead of stdout |
-o START | (with -c) Split output into multiple files starting at a given file number |
-t PATTERN | Use a specific pattern: @=lower alpha, ,=upper alpha, %=numeric, ^=symbols |
-s STRING | Start generating from a specific string (resume-like) |
-c NUMBER | Number of lines per output file when splitting |
-p WORD1 WORD2... | Generate permutations of the given words (no repeats; disables min/max length) |
-P WORD1 WORD2... | Same as -p, but shows the % complete counter |
-d NUM CHARSET | Limit consecutive duplicate characters in output |
-e STRING | Stop generating at a specific string |
-l | Used with -t to treat @,%^ as literal characters instead of placeholders |
-b SIZE | Output size limit per file (e.g., -b 5mb) — used with -o START |
-z FORMAT | Compress output (gzip, bzip2, lzma, 7z) |
-q FILE | Use a wordlist FILE as input for -p/-P style permutation |
-i | Invert the output order (change least-significant character first) |
-v | Verbose/version information |
Basic Usage
crunch 4 4 0123456789
Expected output:
Crunch will now generate the following amount of data: 110000 bytes
0 MB
0 GB
0 TB
0 PB
Crunch will now generate the following number of lines: 10000
0000
0001
0002
0003
0004
...
9999
Practical Examples
Example 1 — Generate all 4-digit numeric PINs to a file
crunch 4 4 0123456789 -o pins.txt
Crunch will now generate the following amount of data: 50000 bytes
Crunch will now generate the following number of lines: 10000
100%
Example 2 — Generate lowercase letter combinations of length 3–5
crunch 3 5 abcdefghijklmnopqrstuvwxyz -o alpha_words.txt
Crunch will now generate the following amount of data: 68078400 bytes (64 MB)
Crunch will now generate the following number of lines: 12356630
Example 3 — Pattern-based generation: 3 letters followed by 2 digits
crunch 5 5 -t @@@%% -o pattern_words.txt
Crunch will now generate the following number of lines: 1757600
abc12
abc13
abc14
...
Example 4 — Using a predefined charset from the charset library
crunch 8 8 -f /usr/share/crunch/charset.lst mixalpha-numeric -o strong_wordlist.txt
Crunch will now generate the following amount of data: 3379200000000 bytes (~3.1 TB)
[!] WARNING: This is a very large amount of data. Consider a narrower charset or shorter length.
Example 5 — Permutations of specific known words
crunch 6 6 -p Summer Winter Spring Autumn
Crunch will now generate the following number of lines: 24
SummerWinter
SummerSpring
SummerAutumn
WinterSummer
...
Example 6 — Splitting output into multiple files for distributed cracking
crunch 6 6 0123456789 -c 100000 -o START
Crunch will now generate the following number of lines: 1000000
Generating output split into 10 files of 100000 lines each:
crunch1.txt crunch2.txt ... crunch10.txt
Example 7 — Piping Crunch output directly into another tool (no disk write)
crunch 4 4 0123456789 | hashcat -m 0 -a 0 hash.txt
[*] Crunch streaming 10000 candidates directly into Hashcat stdin mode
Session..........: hashcat
Status...........: Cracked
Example 8 — Compressed output to save disk space
crunch 6 6 0123456789 -o pins6.txt.gz -z gzip
Crunch will now generate the following number of lines: 1000000
Compressing output with gzip...
Done: pins6.txt.gz (2.1 MB)
Common Use Cases
- Generating complete keyspaces for short PINs, access codes, or license-plate-style formats
- Creating custom charset wordlists to match a known password policy (e.g., “8 characters, letters + digits only”)
- Feeding Hashcat/John directly via a pipe for brute-force mask-style attacks without pre-writing massive files to disk
- Splitting extremely large keyspaces across multiple machines for distributed cracking
- Testing exact password policy edge cases during a security assessment (e.g., “does the app allow single-character passwords?”)
Automation with Bash
#!/bin/bash
# crunch-to-hashcat.sh — stream a numeric keyspace straight into Hashcat, no disk usage
HASH_FILE="ntlm_hashes.txt"
crunch 6 8 0123456789 | hashcat -m 1000 -a 0 "$HASH_FILE"
#!/bin/bash
# crunch-policy-test.sh — build wordlists matching several password-policy shapes
mkdir -p policy_lists
crunch 8 8 -t @@@@%%%% -o policy_lists/4letter_4digit.txt
crunch 8 8 -t ,@@@%%%^ -o policy_lists/cap_mixed.txt
crunch 6 6 0123456789 -o policy_lists/6digit_pin.txt
echo "[*] Policy-matching wordlists generated in ./policy_lists/"
Tips and Best Practices
- Always run Crunch without
-ofirst (or check the size estimate it prints) before generating — it warns you about output size, but large charset+length combos can fill a disk in seconds. - Prefer piping Crunch directly into Hashcat/John over writing enormous files to disk whenever the keyspace is large — this avoids storage and I/O bottlenecks entirely.
- Use
-tpatterns whenever you know the exact structure of the target’s password policy (e.g., a legacy system that always issues “Word####” style default passwords). - For anything beyond ~7-8 character full keyspace with a large charset, prefer Hashcat’s built-in
-a 3mask attack instead of Crunch — it is far faster since Hashcat generates candidates on the GPU rather than reading them from disk/pipe. - Use
-p/-Pwhen you already have a short, curated list of meaningful words (e.g., from CeWL) and want every permutation/order of them.
Troubleshooting
| Problem | Cause / Fix |
|---|---|
| Crunch estimates hundreds of GB/TB of output | Narrow the charset or length range; consider using Hashcat mask mode instead of pre-generating a file |
| Command runs but produces no visible output | You forgot -o; without it, Crunch prints to stdout, which can look like it’s hanging on a huge keyspace — pipe to head to sample it |
-t pattern produces unexpected literal characters | Remember @,%^ are placeholders; use -l if you actually want those characters to appear literally |
| Disk fills up mid-generation | Use -c/-b to split output, or pipe directly into the consuming tool instead of writing to disk |
Permutation mode (-p) ignores min/max length | This is expected — -p/-P generate permutations of the given words only, length arguments are ignored in this mode |
References
- SourceForge project: https://sourceforge.net/projects/crunch-wordlist/
- Kali Linux tool page: https://www.kali.org/tools/crunch/
- Man page:
man crunch
