Hashcat is widely regarded as the world’s fastest and most advanced password/hash recovery tool, created by Jens “atom” Steube. Its defining feature is GPU acceleration — Hashcat uses OpenCL/CUDA to run cracking operations across GPU compute units in parallel, achieving order-of-magnitude speed improvements over CPU-only tools like John the Ripper for many hash types, especially fast, unsalted formats like NTLM and MD5.
Hashcat supports over 350 hash-type “modes” (-m), covering everything from simple MD5/SHA1 to complex salted formats, WPA/WPA2/WPA3 handshakes, Windows NTLM/DCC2, Kerberos tickets (Kerberoasting/AS-REP roasting), macOS/Linux shadow formats, database hashes, cryptocurrency wallet hashes, and document/archive passwords. It offers seven distinct attack modes (-a), including straight dictionary, combinator, brute-force/mask, hybrid, and rule-based attacks, and includes a powerful built-in rule engine for wordlist mutation similar to (and compatible in concept with) John’s.
Key Features
- GPU-accelerated (OpenCL/CUDA/HIP) cracking, dramatically faster than CPU-only tools for most hash types
- 7 attack modes: straight (
0), combination (1), brute-force/mask (3), hybrid wordlist+mask (6/7), association (9) - 350+ built-in hash-mode identifiers (
-m) - Rule-based mutation engine (
-r) with bundled rule files (best64.rule,rockyou-30000.rule, etc.) - Session save/resume (
--session,--restore) - Benchmark mode (
-b) to measure raw hash-rate per algorithm on your hardware - Potfile tracking of cracked hashes across sessions (
--show,--left)
Installation
Hashcat is preinstalled on Kali Linux. To install/update manually:
sudo apt update
sudo apt install hashcat -y
Verify installation and detect available GPU/CPU devices:
hashcat -I
From source / latest release:
git clone https://github.com/hashcat/hashcat.git
cd hashcat
make
sudo make install
Ensure proper GPU drivers are installed for acceleration (NVIDIA CUDA toolkit, or AMD ROCm/OpenCL, or Mesa OpenCL for integrated GPUs) — without them Hashcat falls back to slower CPU-only mode.
Syntax
hashcat [options] hashfile [dictionary|mask|directory]
Command-Line Options
| Option | Description |
|---|---|
-m NUM | Hash type (mode), e.g. 0=MD5, 100=SHA1, 1000=NTLM, 1800=sha512crypt, 22000=WPA-PBKDF2-PMKID+EAPOL |
-a NUM | Attack mode: 0=straight (wordlist), 1=combination, 3=brute-force/mask, 6=hybrid wordlist+mask, 7=hybrid mask+wordlist, 9=association |
-o FILE | Write cracked results to FILE |
--outfile-format=N | Format of the output file (hash, plain, hash:plain, etc.) |
-r FILE | Apply a rule file to mutate wordlist candidates |
-e | Enable “hex charset”/other special parsing (context-dependent) |
-1/-2/-3/-4 CHARSET | Define custom charsets for mask attacks |
--increment | Try progressively longer masks, from --increment-min to the mask’s full length |
--increment-min=N | Minimum length for --increment |
--increment-max=N | Maximum length for --increment |
-w NUM | Workload profile (1=low, 2=default, 3=high, 4=nightmare) |
-O | Optimized kernel (faster, but restricts max password length per algorithm) |
-b | Run benchmark mode |
-I | Show detected OpenCL/CUDA devices |
-d LIST | Restrict to specific device IDs |
--session=NAME | Name the session for save/resume |
--restore | Restore a previous session |
--status | Enable automatic status screen updates |
--status-timer=SEC | Interval for status updates |
--show | Show already-cracked hashes from the potfile |
--left | Show hashes NOT yet cracked |
--username | Strip a username field from the hash file before processing |
--potfile-path=FILE | Use a custom potfile |
--force | Bypass certain hardware/warning checks (use cautiously) |
--hex-salt | Treat the salt as hex-encoded |
-1 ?l?u?d (example) | Define custom charset 1 as lower+upper+digit |
?l ?u ?d ?s ?a | Built-in mask placeholders: lower, upper, digit, special, all-printable |
--stdout | Print generated candidates instead of cracking (for piping/testing) |
Basic Usage
hashcat -m 0 -a 0 md5_hashes.txt /usr/share/wordlists/rockyou.txt
Expected output:
hashcat (v6.2.6) starting
* Device #1: NVIDIA GeForce RTX 3060, 4096/12288 MB, 28MCU
Dictionary cache built:
* Filename..: rockyou.txt
* Passwords.: 14344399
5f4dcc3b5aa765d61d8327deb882cf99:password
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 0 (MD5)
Hash.Target......: md5_hashes.txt
Time.Started.....: Sun Jul 19 11:45:02 2026 (2 secs)
Guess.Base.......: File (rockyou.txt)
Speed.#1.........: 890.1 MH/s
Recovered........: 1/1 (100.00%) Digests
Practical Examples
Example 1 — Straight dictionary attack against MD5 hashes
hashcat -m 0 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt
5f4dcc3b5aa765d61d8327deb882cf99:password
Recovered........: 1/1 (100.00%) Digests
Example 2 — Cracking Windows NTLM hashes with a rule file
hashcat -m 1000 -a 0 ntlm_hashes.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule
31d6cfe0d16ae931b73c59d7e0c089c0:(empty)
8846f7eaee8fb117ad06bda830b7586c:Password1!
Recovered........: 2/5 (40.00%) Digests
Example 3 — Brute-force mask attack for a 6-digit PIN
hashcat -m 0 -a 3 pin_hashes.txt ?d?d?d?d?d?d
Guess.Mask.......: ?d?d?d?d?d?d [6]
Speed.#1.........: 3200.5 MH/s
042719:e10adc3949ba59abbe56e057f20f883e
Recovered........: 1/1 (100.00%) Digests
Example 4 — Cracking a captured WPA2 handshake (converted with hcxpcapngtool)
hashcat -m 22000 -a 0 wpa_handshake.hc22000 /usr/share/wordlists/rockyou.txt
Recovered........: 1/1 (100.00%) Digests
homenetwork24:HomeWiFi
Example 5 — Hybrid wordlist + mask attack (word + 4-digit suffix)
hashcat -m 1000 -a 6 ntlm_hashes.txt words.txt ?d?d?d?d
Company2024:CompanyName
Recovered........: 1/3 (33.33%) Digests
Example 6 — Combination attack (word1 + word2)
hashcat -m 0 -a 1 hashes.txt wordlist1.txt wordlist2.txt
SummerWinter:5b3338c50a9d1c5db0e2a5cd8b5f9c6d
Recovered........: 1/1 (100.00%) Digests
Example 7 — Custom charset mask (uppercase+digit only, length 8)
hashcat -m 0 -a 3 -1 ?u?d hashes.txt ?1?1?1?1?1?1?1?1
Guess.Mask.......: ?1?1?1?1?1?1?1?1 [8]
A1B2C3D4:098f6bcd4621d373cade4e832627b4f6
Example 8 — Benchmarking hash-cracking speed on the current GPU
hashcat -b -m 1000
Hashmode: 1000 - NTLM
Speed.#1.........: 25631.2 MH/s
Example 9 — Resuming a previously interrupted session
hashcat -m 1000 -a 0 ntlm_hashes.txt rockyou.txt --session=ntlm_audit
# ... interrupted ...
hashcat --session=ntlm_audit --restore
Session..........: ntlm_audit
Status...........: Running
Restored.........: 6291456/14344399 (43.87%)
Example 10 — Showing already-cracked hashes
hashcat -m 0 hashes.txt --show
5f4dcc3b5aa765d61d8327deb882cf99:password
8846f7eaee8fb117ad06bda830b7586c:Password1!
Common Use Cases
- Cracking dumped Windows NTLM/NTLMv2/Net-NTLM hashes at high speed on GPU hardware
- Recovering WPA/WPA2/WPA3 Wi-Fi passphrases from captured handshakes or PMKIDs
- Kerberoasting/AS-REP roasting attacks against Active Directory service accounts (hash modes 13100/18200)
- Auditing organization-wide password strength across a large hash dump (thousands of accounts) far faster than CPU tools
- Cracking hashes extracted from databases, CMS platforms, or custom applications during a web app assessment
Automation with Bash
#!/bin/bash
# hashcat-full-audit.sh — layered attack: quick wordlist, then rules, then mask fallback
HASHFILE="ntlm_hashes.txt"
WORDLIST="/usr/share/wordlists/rockyou.txt"
echo "[*] Stage 1: straight dictionary attack"
hashcat -m 1000 -a 0 "$HASHFILE" "$WORDLIST" --session=stage1
echo "[*] Stage 2: rule-based mutation"
hashcat -m 1000 -a 0 "$HASHFILE" "$WORDLIST" -r /usr/share/hashcat/rules/best64.rule --session=stage2
echo "[*] Stage 3: mask fallback for remaining hashes (8-char, mixed alnum)"
hashcat -m 1000 -a 3 "$HASHFILE" ?a?a?a?a?a?a?a?a --session=stage3
echo "[*] Final results:"
hashcat -m 1000 "$HASHFILE" --show
#!/bin/bash
# hashcat-wpa-crack.sh — convert capture and crack a WPA handshake
hcxpcapngtool -o handshake.hc22000 capture.pcapng
hashcat -m 22000 -a 0 handshake.hc22000 /usr/share/wordlists/rockyou.txt
Tips and Best Practices
- Always run
-b(benchmark) once after setup to confirm GPU acceleration is actually active — a huge, unexpected slowdown usually means Hashcat has fallen back to CPU-only mode due to missing drivers. - Layer attacks: start with straight dictionary + best64 rules (fast, high yield), then escalate to larger rule sets (
rockyou-30000.rule), then hybrid/mask attacks for anything remaining. - Use
-O(optimized kernels) for a significant speed boost, but be aware it caps maximum crackable password length for some algorithms — drop it if you suspect very long passphrases. - Use
--sessionon every meaningful run; large hash sets and full keyspace masks can run for hours or days, and--restoreis essential. - Match
-w(workload) to your situation: use-w 1or-w 2on a machine you’re also using interactively, and-w 3/-w 4on a dedicated cracking rig.
Troubleshooting
| Problem | Cause / Fix |
|---|---|
No devices found/left | GPU drivers/OpenCL runtime not installed; install CUDA (NVIDIA) or ROCm/Mesa OpenCL (AMD/Intel), then re-run hashcat -I |
| Cracking speed unexpectedly low | Hashcat may have fallen back to CPU; verify with -I and -b; also check -O isn’t disabled unnecessarily |
Token length exception when loading hash file | Hash format doesn’t match the selected -m mode, or the file has extra fields (e.g., username:hash) — use --username or strip extra columns |
--restore fails | Session name/.restore file mismatch, or the hash file/arguments changed since the session was saved — restores must use identical parameters |
| Out-of-memory errors on large wordlists/rules combos | Reduce -w, split the rule file, or increase --kernel-accel/--kernel-loops tuning cautiously |
References
- Official site: https://hashcat.net/hashcat/
- GitHub: https://github.com/hashcat/hashcat
- Kali Linux tool page: https://www.kali.org/tools/hashcat/
- Hash mode reference: https://hashcat.net/wiki/doku.php?id=example_hashes