Crunch Tool in Kali Linux: A Comprehensive Guide

Crunch is a wordlist and keyspace generator that creates permutations and combinations of characters based on rules you specify — character sets, minimum/maximum length, patterns, and more. Unlike CeWL (which derives words from real-world content) or CUPP (which derives candidates from personal information), Crunch generates every possible combination within a defined character set and length range, making it the tool of choice for true brute-force keyspace generation, such as cracking short numeric PINs, generating all possible license plate formats, or feeding a custom-charset mask attack into Hashcat/John.

Crunch calculates the required disk space before generating output and warns you if the resulting wordlist would be too large for available storage. It supports custom character sets, patterns (using @, ,, %, ^ placeholders for lower, upper, numeric, and symbol characters respectively), and can pipe directly into another tool instead of writing to disk.

Key Features

• Generates exact character permutations for any given min/max length and charset
• Pattern-based generation (-t) for structured formats (e.g., 3 letters + 4 digits)
• Built-in charset file (/usr/share/crunch/charset.lst) with predefined sets (numeric, alpha, symbols, hex, etc.)
• Can split output across multiple files for distributed cracking (-o START, -c, -p)
• Can pipe output directly to stdout for use with other tools without writing to disk

Installation

Crunch is preinstalled on Kali Linux. To install/update manually:

sudo apt update
sudo apt install crunch -y

Verify:

crunch --help

From source:

wget https://sourceforge.net/projects/crunch-wordlist/files/latest/download -O crunch.tgz
tar -xzf crunch.tgz
cd crunch-*
make
sudo make install

Syntax

crunch <min-len> <max-len> [charset] [options]

Command-Line Options

Option	Description
min-len	Minimum length of generated strings (required, positional)
max-len	Maximum length of generated strings (required, positional)
charset	Character set to use (positional, optional — defaults to lowercase a-z)
-f FILE SETNAME	Load a named character set from a charset file (e.g., /usr/share/crunch/charset.lst)
-o FILE	Output to FILE instead of stdout
-o START	(with -c) Split output into multiple files starting at a given file number
-t PATTERN	Use a specific pattern: @=lower alpha, ,=upper alpha, %=numeric, ^=symbols
-s STRING	Start generating from a specific string (resume-like)
-c NUMBER	Number of lines per output file when splitting
-p WORD1 WORD2...	Generate permutations of the given words (no repeats; disables min/max length)
-P WORD1 WORD2...	Same as -p, but shows the % complete counter
-d NUM CHARSET	Limit consecutive duplicate characters in output
-e STRING	Stop generating at a specific string
-l	Used with -t to treat @,%^ as literal characters instead of placeholders
-b SIZE	Output size limit per file (e.g., -b 5mb) — used with -o START
-z FORMAT	Compress output (gzip, bzip2, lzma, 7z)
-q FILE	Use a wordlist FILE as input for -p/-P style permutation
-i	Invert the output order (change least-significant character first)
-v	Verbose/version information

Basic Usage

crunch 4 4 0123456789

Expected output:

Crunch will now generate the following amount of data: 110000 bytes
0 MB
0 GB
0 TB
0 PB
Crunch will now generate the following number of lines: 10000

0000
0001
0002
0003
0004
...
9999

Practical Examples

Example 1 — Generate all 4-digit numeric PINs to a file

crunch 4 4 0123456789 -o pins.txt

Crunch will now generate the following amount of data: 50000 bytes
Crunch will now generate the following number of lines: 10000
100%

Example 2 — Generate lowercase letter combinations of length 3–5

crunch 3 5 abcdefghijklmnopqrstuvwxyz -o alpha_words.txt

Crunch will now generate the following amount of data: 68078400 bytes (64 MB)
Crunch will now generate the following number of lines: 12356630

Example 3 — Pattern-based generation: 3 letters followed by 2 digits

crunch 5 5 -t @@@%% -o pattern_words.txt

Crunch will now generate the following number of lines: 1757600
abc12
abc13
abc14
...

Example 4 — Using a predefined charset from the charset library

crunch 8 8 -f /usr/share/crunch/charset.lst mixalpha-numeric -o strong_wordlist.txt

Crunch will now generate the following amount of data: 3379200000000 bytes (~3.1 TB)
[!] WARNING: This is a very large amount of data. Consider a narrower charset or shorter length.

Example 5 — Permutations of specific known words

crunch 6 6 -p Summer Winter Spring Autumn

Crunch will now generate the following number of lines: 24
SummerWinter
SummerSpring
SummerAutumn
WinterSummer
...

Example 6 — Splitting output into multiple files for distributed cracking

crunch 6 6 0123456789 -c 100000 -o START

Crunch will now generate the following number of lines: 1000000
Generating output split into 10 files of 100000 lines each:
  crunch1.txt crunch2.txt ... crunch10.txt

Example 7 — Piping Crunch output directly into another tool (no disk write)

crunch 4 4 0123456789 | hashcat -m 0 -a 0 hash.txt

[*] Crunch streaming 10000 candidates directly into Hashcat stdin mode
Session..........: hashcat
Status...........: Cracked

Example 8 — Compressed output to save disk space

crunch 6 6 0123456789 -o pins6.txt.gz -z gzip

Crunch will now generate the following number of lines: 1000000
Compressing output with gzip...
Done: pins6.txt.gz (2.1 MB)

Common Use Cases

• Generating complete keyspaces for short PINs, access codes, or license-plate-style formats
• Creating custom charset wordlists to match a known password policy (e.g., “8 characters, letters + digits only”)
• Feeding Hashcat/John directly via a pipe for brute-force mask-style attacks without pre-writing massive files to disk
• Splitting extremely large keyspaces across multiple machines for distributed cracking
• Testing exact password policy edge cases during a security assessment (e.g., “does the app allow single-character passwords?”)

Automation with Bash

#!/bin/bash
# crunch-to-hashcat.sh — stream a numeric keyspace straight into Hashcat, no disk usage
HASH_FILE="ntlm_hashes.txt"
crunch 6 8 0123456789 | hashcat -m 1000 -a 0 "$HASH_FILE"

#!/bin/bash
# crunch-policy-test.sh — build wordlists matching several password-policy shapes
mkdir -p policy_lists
crunch 8 8 -t @@@@%%%% -o policy_lists/4letter_4digit.txt
crunch 8 8 -t ,@@@%%%^ -o policy_lists/cap_mixed.txt
crunch 6 6 0123456789 -o policy_lists/6digit_pin.txt
echo "[*] Policy-matching wordlists generated in ./policy_lists/"

Tips and Best Practices

• Always run Crunch without -o first (or check the size estimate it prints) before generating — it warns you about output size, but large charset+length combos can fill a disk in seconds.
• Prefer piping Crunch directly into Hashcat/John over writing enormous files to disk whenever the keyspace is large — this avoids storage and I/O bottlenecks entirely.
• Use -t patterns whenever you know the exact structure of the target’s password policy (e.g., a legacy system that always issues “Word####” style default passwords).
• For anything beyond ~7-8 character full keyspace with a large charset, prefer Hashcat’s built-in -a 3 mask attack instead of Crunch — it is far faster since Hashcat generates candidates on the GPU rather than reading them from disk/pipe.
• Use -p/-P when you already have a short, curated list of meaningful words (e.g., from CeWL) and want every permutation/order of them.

Troubleshooting

Problem	Cause / Fix
Crunch estimates hundreds of GB/TB of output	Narrow the charset or length range; consider using Hashcat mask mode instead of pre-generating a file
Command runs but produces no visible output	You forgot -o; without it, Crunch prints to stdout, which can look like it’s hanging on a huge keyspace — pipe to head to sample it
-t pattern produces unexpected literal characters	Remember @,%^ are placeholders; use -l if you actually want those characters to appear literally
Disk fills up mid-generation	Use -c/-b to split output, or pipe directly into the consuming tool instead of writing to disk
Permutation mode (-p) ignores min/max length	This is expected — -p/-P generate permutations of the given words only, length arguments are ignored in this mode

References

• SourceForge project: https://sourceforge.net/projects/crunch-wordlist/
• Kali Linux tool page: https://www.kali.org/tools/crunch/
• Man page: man crunch