john: Password cracking tool (John the Ripper)

John the Ripper (often shortened to “John” or “JtR”) is one of the most well-established offline password/hash cracking tools in existence, originally released in 1996 by Solar Designer (Openwall). It is designed to detect weak passwords by cracking hashes obtained from operating systems, applications, and captured network handshakes. Kali Linux ships the “Jumbo” community-enhanced edition, which extends the original John with support for hundreds of additional hash formats (Windows NTLM/LM, Linux /etc/shadow crypt formats, ZIP/RAR/7z archive passwords, PDF and Office document passwords, WPA/WPA2 handshakes, database hashes, and many more), plus additional cracking modes.

John supports three primary attack modes: single crack mode (uses login/GECOS field info as candidates, similar in spirit to CUPP), wordlist mode (dictionary attack, optionally with mangling rules), and incremental mode (true brute-force across a defined character set, similar to Crunch but generated internally and far more efficient). It also includes a rich rule engine for mutating wordlist entries and can auto-detect most hash formats.

Key Features

• Auto-detects the hash type in most cases (or format can be explicitly specified)
• Extremely flexible and powerful rule-based wordlist mangling engine
• --format support for hundreds of hash/cipher types via the Jumbo patch set
• Session save/resume support for long-running cracks
• Companion utilities: zip2john, rar2john, ssh2john, office2john, pdf2john, unshadow, and dozens more, which convert files/hashes into a John-crackable format
• john --show to display already-cracked passwords from the pot file at any time

Installation

John the Ripper (Jumbo) is preinstalled on Kali Linux. To install/update manually:

sudo apt update
sudo apt install john -y

Verify:

john --version

Building the latest Jumbo version from source:

git clone https://github.com/openwall/john.git john-jumbo
cd john-jumbo/src
./configure && make -s clean && make -sj$(nproc)

Syntax

john [options] [password-files]

Command-Line Options

Option	Description
--wordlist=FILE	Use dictionary/wordlist mode with FILE
--rules[=NAME]	Apply mangling rules to the wordlist (default ruleset, or a named one from john.conf)
--single	Single crack mode (uses username/GECOS info as candidates)
--incremental[=MODE]	Incremental (brute-force) mode; MODE selects a charset (e.g., Digits, Alpha, ASCII)
--mask=MASK	Mask attack using placeholders (?l,?u,?d,?s,?a)
--format=NAME	Force a specific hash format (e.g., raw-md5, nt, sha512crypt, wpapsk)
--list=formats	List all supported hash formats
--users=LOGIN	Restrict cracking to specific username(s)
--show	Show already-cracked passwords for a hash file from the pot file
--show=left	Show only hashes that have NOT yet been cracked
--pot=FILE	Use a specific pot file instead of the default john.pot
--session=NAME	Name a session for later resuming
--restore[=NAME]	Restore/resume a previous session
--fork=N	Fork N processes for parallel CPU cracking
--status	Show the status of a running/paused session
--test[=TIME]	Benchmark John’s cracking speed for the current formats
--stdout	Print candidate passwords instead of attempting to crack (useful for piping)
--min-length=N / --max-length=N	Restrict candidate password length
--external=NAME	Use a custom external mode/filter defined in john.conf
--devices=LIST	Specify OpenCL devices for GPU-accelerated formats
--markov=OPTIONS	Markov-chain based candidate generation
--loopback[=FILE]	Feed previously cracked passwords back in as a wordlist (great for iterative cracking of a large hash set)

Basic Usage

john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt

Expected output:

Using default input encoding: UTF-8
Loaded 3 password hashes with 3 different salts (sha512crypt, crypt(3) $6$ [SHA512 128/128 AVX 2x])
Press 'q' or Ctrl-C to abort, almost any other key for status
summer2023       (jsmith)
letmein123       (mjones)
2g 0:00:00:04 DONE (2026-07-19 11:32) 0.4761g/s 10240p/s 10240c/s 10240C/s
Use the "--show" option to display all of the cracked passwords reliably
Session completed.

Practical Examples

Example 1 — Cracking /etc/shadow hashes (after unshadowing)

sudo unshadow /etc/passwd /etc/shadow > combined.txt
john --wordlist=/usr/share/wordlists/rockyou.txt combined.txt

Loaded 4 password hashes with 4 different salts
Passw0rd!        (root)
1g 0:00:00:12 DONE

Example 2 — Cracking a Windows NTLM hash dump

john --format=nt --wordlist=/usr/share/wordlists/rockyou.txt ntlm_hashes.txt

Loaded 5 password hashes with no different salts (NT [MD4 128/128 AVX 4x3])
Welcome2024      (helpdesk)
Admin123!        (Administrator)
2g 0:00:00:07 DONE

Example 3 — Rule-based mutation of a wordlist

john --wordlist=custom.txt --rules=Jumbo hashes.txt

Loaded 3 password hashes
J0hn1990!        (jsmith)
2g 0:00:03:21 DONE

Example 4 — Cracking a zip archive password

zip2john secret.zip > zip_hash.txt
john --wordlist=/usr/share/wordlists/rockyou.txt zip_hash.txt

Loaded 1 password hash (PKZIP [32/64])
vacation2023     (secret.zip)
1g 0:00:00:02 DONE

Example 5 — Mask attack for a known 6-digit numeric PIN

john --mask=?d?d?d?d?d?d --format=raw-md5 pin_hashes.txt

Loaded 1 password hash (Raw-MD5 [MD5 128/128 AVX 4x3])
042719           (user1)
1g 0:00:00:08 DONE

Example 6 — Single crack mode using GECOS/username info

john --single --format=raw-md5 hashes.txt

Loaded 2 password hashes
jsmith123        (jsmith)
1g 0:00:00:01 DONE

Example 7 — Session save and resume for a long-running crack

john --wordlist=rockyou.txt --session=bigcrack hashes.txt
# ... interrupted with Ctrl+C ...
john --restore=bigcrack

Session bigcrack aborted, saving state
Loaded from resumed session bigcrack
1g 0:04:12:33 DONE

Example 8 — Displaying already-cracked passwords

john --show hashes.txt

jsmith:summer2023:::::
mjones:letmein123:::::

2 password hashes cracked, 1 left

Example 9 — Cracking a captured WPA2 handshake

john --format=wpapsk --wordlist=/usr/share/wordlists/rockyou.txt wpa_handshake.txt

Loaded 1 password hash (WPAPSK-PMK [PBKDF2-SHA1 256/256 AVX2 8x])
homenetwork24    (HomeWiFi)
1g 0:00:14:02 DONE

Example 10 — Benchmark John’s speed on the current hardware

john --test --format=nt

Benchmarking: NT [MD4 128/128 AVX 4x3]... DONE
Raw:    45123K c/s real, 45123K c/s virtual

Common Use Cases

• Cracking Linux /etc/shadow password hashes obtained after privilege escalation
• Cracking dumped Windows SAM/NTLM hashes obtained via Mimikatz, secretsdump.py, or similar tools
• Recovering passwords from protected ZIP/RAR/7z/PDF/Office documents found during an assessment
• Cracking WPA/WPA2 handshakes captured with aircrack-ng/hcxdumptool
• Auditing an organization’s password strength as part of a compliance/policy review

Automation with Bash

#!/bin/bash
# john-full-audit.sh — unshadow + crack + report in one pipeline
sudo unshadow /etc/passwd /etc/shadow > /tmp/combined.txt
john --wordlist=/usr/share/wordlists/rockyou.txt --rules=Jumbo /tmp/combined.txt
echo "[*] Cracked accounts:"
john --show /tmp/combined.txt

#!/bin/bash
# john-loopback-crack.sh — iteratively crack a large hash set, feeding cracked passwords back in
HASHFILE="ntlm_hashes.txt"
john --format=nt --wordlist=/usr/share/wordlists/rockyou.txt "$HASHFILE"
john --format=nt --loopback --rules=Jumbo "$HASHFILE"
john --show --format=nt "$HASHFILE"

Tips and Best Practices

• Always run --format= explicitly once you know the hash type — auto-detection is convenient but can occasionally misidentify ambiguous hash formats.
• Use --rules=Jumbo (or a custom rule set in john.conf) on every wordlist run — raw dictionary attacks without rules miss the vast majority of real-world passwords, which are typically mutated (“Password1!” not “password”).
• Use --session on any crack expected to run more than a few minutes so it can be safely paused and resumed.
• Use --loopback after a successful wordlist crack against a large hash set — passwords cracked from one account are often reused (with minor variation) by others in the same organization.
• Convert exotic file types (zip2john, rar2john, ssh2john, office2john, pdf2john) rather than trying to hand-craft a hash format — the *2john utilities handle this correctly and are included with the Jumbo build.

Troubleshooting

Problem	Cause / Fix
No password hashes loaded	Hash format wasn’t recognized or the file format is wrong; specify --format= explicitly, or verify the hash was extracted correctly with the right *2john tool
Crack finishes instantly with 0 cracked	Wordlist doesn’t contain the password; try adding --rules, a bigger wordlist, or a mask/incremental attack
--restore fails with “no such session”	The --session name must match exactly, and the .rec file must still exist in John’s run directory
Extremely slow cracking	Use --test to benchmark; consider switching to Hashcat for GPU-accelerated hash types where speed matters most
Duplicate cracked output shown repeatedly	Use --show instead of re-running the full crack; John will skip already-cracked hashes automatically on subsequent runs using the same pot file

References

• Official site: https://www.openwall.com/john/
• GitHub (Jumbo): https://github.com/openwall/john
• Kali Linux tool page: https://www.kali.org/tools/john/
• Wiki/docs: https://github.com/openwall/john/wiki