John the Ripper (often shortened to “John” or “JtR”) is one of the most well-established offline password/hash cracking tools in existence, originally released in 1996 by Solar Designer (Openwall). It is designed to detect weak passwords by cracking hashes obtained from operating systems, applications, and captured network handshakes. Kali Linux ships the “Jumbo” community-enhanced edition, which extends the original John with support for hundreds of additional hash formats (Windows NTLM/LM, Linux /etc/shadow crypt formats, ZIP/RAR/7z archive passwords, PDF and Office document passwords, WPA/WPA2 handshakes, database hashes, and many more), plus additional cracking modes.
John supports three primary attack modes: single crack mode (uses login/GECOS field info as candidates, similar in spirit to CUPP), wordlist mode (dictionary attack, optionally with mangling rules), and incremental mode (true brute-force across a defined character set, similar to Crunch but generated internally and far more efficient). It also includes a rich rule engine for mutating wordlist entries and can auto-detect most hash formats.
Key Features
- Auto-detects the hash type in most cases (or format can be explicitly specified)
- Extremely flexible and powerful rule-based wordlist mangling engine
--formatsupport for hundreds of hash/cipher types via the Jumbo patch set- Session save/resume support for long-running cracks
- Companion utilities:
zip2john,rar2john,ssh2john,office2john,pdf2john,unshadow, and dozens more, which convert files/hashes into a John-crackable format john --showto display already-cracked passwords from the pot file at any time
Installation
John the Ripper (Jumbo) is preinstalled on Kali Linux. To install/update manually:
sudo apt update
sudo apt install john -y
Verify:
john --version
Building the latest Jumbo version from source:
git clone https://github.com/openwall/john.git john-jumbo
cd john-jumbo/src
./configure && make -s clean && make -sj$(nproc)
Syntax
john [options] [password-files]
Command-Line Options
| Option | Description |
|---|---|
--wordlist=FILE | Use dictionary/wordlist mode with FILE |
--rules[=NAME] | Apply mangling rules to the wordlist (default ruleset, or a named one from john.conf) |
--single | Single crack mode (uses username/GECOS info as candidates) |
--incremental[=MODE] | Incremental (brute-force) mode; MODE selects a charset (e.g., Digits, Alpha, ASCII) |
--mask=MASK | Mask attack using placeholders (?l,?u,?d,?s,?a) |
--format=NAME | Force a specific hash format (e.g., raw-md5, nt, sha512crypt, wpapsk) |
--list=formats | List all supported hash formats |
--users=LOGIN | Restrict cracking to specific username(s) |
--show | Show already-cracked passwords for a hash file from the pot file |
--show=left | Show only hashes that have NOT yet been cracked |
--pot=FILE | Use a specific pot file instead of the default john.pot |
--session=NAME | Name a session for later resuming |
--restore[=NAME] | Restore/resume a previous session |
--fork=N | Fork N processes for parallel CPU cracking |
--status | Show the status of a running/paused session |
--test[=TIME] | Benchmark John’s cracking speed for the current formats |
--stdout | Print candidate passwords instead of attempting to crack (useful for piping) |
--min-length=N / --max-length=N | Restrict candidate password length |
--external=NAME | Use a custom external mode/filter defined in john.conf |
--devices=LIST | Specify OpenCL devices for GPU-accelerated formats |
--markov=OPTIONS | Markov-chain based candidate generation |
--loopback[=FILE] | Feed previously cracked passwords back in as a wordlist (great for iterative cracking of a large hash set) |
Basic Usage
john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt
Expected output:
Using default input encoding: UTF-8
Loaded 3 password hashes with 3 different salts (sha512crypt, crypt(3) $6$ [SHA512 128/128 AVX 2x])
Press 'q' or Ctrl-C to abort, almost any other key for status
summer2023 (jsmith)
letmein123 (mjones)
2g 0:00:00:04 DONE (2026-07-19 11:32) 0.4761g/s 10240p/s 10240c/s 10240C/s
Use the "--show" option to display all of the cracked passwords reliably
Session completed.
Practical Examples
Example 1 — Cracking /etc/shadow hashes (after unshadowing)
sudo unshadow /etc/passwd /etc/shadow > combined.txt
john --wordlist=/usr/share/wordlists/rockyou.txt combined.txt
Loaded 4 password hashes with 4 different salts
Passw0rd! (root)
1g 0:00:00:12 DONE
Example 2 — Cracking a Windows NTLM hash dump
john --format=nt --wordlist=/usr/share/wordlists/rockyou.txt ntlm_hashes.txt
Loaded 5 password hashes with no different salts (NT [MD4 128/128 AVX 4x3])
Welcome2024 (helpdesk)
Admin123! (Administrator)
2g 0:00:00:07 DONE
Example 3 — Rule-based mutation of a wordlist
john --wordlist=custom.txt --rules=Jumbo hashes.txt
Loaded 3 password hashes
J0hn1990! (jsmith)
2g 0:00:03:21 DONE
Example 4 — Cracking a zip archive password
zip2john secret.zip > zip_hash.txt
john --wordlist=/usr/share/wordlists/rockyou.txt zip_hash.txt
Loaded 1 password hash (PKZIP [32/64])
vacation2023 (secret.zip)
1g 0:00:00:02 DONE
Example 5 — Mask attack for a known 6-digit numeric PIN
john --mask=?d?d?d?d?d?d --format=raw-md5 pin_hashes.txt
Loaded 1 password hash (Raw-MD5 [MD5 128/128 AVX 4x3])
042719 (user1)
1g 0:00:00:08 DONE
Example 6 — Single crack mode using GECOS/username info
john --single --format=raw-md5 hashes.txt
Loaded 2 password hashes
jsmith123 (jsmith)
1g 0:00:00:01 DONE
Example 7 — Session save and resume for a long-running crack
john --wordlist=rockyou.txt --session=bigcrack hashes.txt
# ... interrupted with Ctrl+C ...
john --restore=bigcrack
Session bigcrack aborted, saving state
Loaded from resumed session bigcrack
1g 0:04:12:33 DONE
Example 8 — Displaying already-cracked passwords
john --show hashes.txt
jsmith:summer2023:::::
mjones:letmein123:::::
2 password hashes cracked, 1 left
Example 9 — Cracking a captured WPA2 handshake
john --format=wpapsk --wordlist=/usr/share/wordlists/rockyou.txt wpa_handshake.txt
Loaded 1 password hash (WPAPSK-PMK [PBKDF2-SHA1 256/256 AVX2 8x])
homenetwork24 (HomeWiFi)
1g 0:00:14:02 DONE
Example 10 — Benchmark John’s speed on the current hardware
john --test --format=nt
Benchmarking: NT [MD4 128/128 AVX 4x3]... DONE
Raw: 45123K c/s real, 45123K c/s virtual
Common Use Cases
- Cracking Linux
/etc/shadowpassword hashes obtained after privilege escalation - Cracking dumped Windows SAM/NTLM hashes obtained via Mimikatz, secretsdump.py, or similar tools
- Recovering passwords from protected ZIP/RAR/7z/PDF/Office documents found during an assessment
- Cracking WPA/WPA2 handshakes captured with
aircrack-ng/hcxdumptool - Auditing an organization’s password strength as part of a compliance/policy review
Automation with Bash
#!/bin/bash
# john-full-audit.sh — unshadow + crack + report in one pipeline
sudo unshadow /etc/passwd /etc/shadow > /tmp/combined.txt
john --wordlist=/usr/share/wordlists/rockyou.txt --rules=Jumbo /tmp/combined.txt
echo "[*] Cracked accounts:"
john --show /tmp/combined.txt
#!/bin/bash
# john-loopback-crack.sh — iteratively crack a large hash set, feeding cracked passwords back in
HASHFILE="ntlm_hashes.txt"
john --format=nt --wordlist=/usr/share/wordlists/rockyou.txt "$HASHFILE"
john --format=nt --loopback --rules=Jumbo "$HASHFILE"
john --show --format=nt "$HASHFILE"
Tips and Best Practices
- Always run
--format=explicitly once you know the hash type — auto-detection is convenient but can occasionally misidentify ambiguous hash formats. - Use
--rules=Jumbo(or a custom rule set injohn.conf) on every wordlist run — raw dictionary attacks without rules miss the vast majority of real-world passwords, which are typically mutated (“Password1!” not “password”). - Use
--sessionon any crack expected to run more than a few minutes so it can be safely paused and resumed. - Use
--loopbackafter a successful wordlist crack against a large hash set — passwords cracked from one account are often reused (with minor variation) by others in the same organization. - Convert exotic file types (
zip2john,rar2john,ssh2john,office2john,pdf2john) rather than trying to hand-craft a hash format — the*2johnutilities handle this correctly and are included with the Jumbo build.
Troubleshooting
| Problem | Cause / Fix |
|---|---|
No password hashes loaded | Hash format wasn’t recognized or the file format is wrong; specify --format= explicitly, or verify the hash was extracted correctly with the right *2john tool |
| Crack finishes instantly with 0 cracked | Wordlist doesn’t contain the password; try adding --rules, a bigger wordlist, or a mask/incremental attack |
--restore fails with “no such session” | The --session name must match exactly, and the .rec file must still exist in John’s run directory |
| Extremely slow cracking | Use --test to benchmark; consider switching to Hashcat for GPU-accelerated hash types where speed matters most |
| Duplicate cracked output shown repeatedly | Use --show instead of re-running the full crack; John will skip already-cracked hashes automatically on subsequent runs using the same pot file |
References
- Official site: https://www.openwall.com/john/
- GitHub (Jumbo): https://github.com/openwall/john
- Kali Linux tool page: https://www.kali.org/tools/john/
- Wiki/docs: https://github.com/openwall/john/wiki
