Hashcat is a free, open-source password-recovery tool billed as the world's fastest password cracker. It uses GPU acceleration to try enormous numbers of candidate passwords per second against captured hashes, supporting hundreds of hash algorithms and several attack modes: straight (wordlist), combinator, brute-force/mask, and hybrid. Security teams use it in authorised password audits and forensics to recover plaintext from hashes and measure real password strength.
Last updated: 6 August 2026
Hashcat is the offline cracking workhorse. Given a file of hashes, you choose the hash mode (-m) and attack mode (-a) and let the GPU do the work: a wordlist run with rules to mangle words, or a mask attack to brute-force a known password pattern. Auditors crack captured NTLM hashes from an Active Directory dump to find weak passwords, and Wi-Fi testers crack WPA handshakes converted to mode 22000. Its rule engine and mask syntax make it far more efficient than blind brute force, and its speed makes large audits practical.
Linux · Windows · macOS
Open source (MIT License)
hashcat -m 1000 -a 0 hashes.txt rockyou.txtStraight dictionary attack against NTLM hashes (-m 1000).
hashcat -m 0 -a 0 hashes.txt rockyou.txt -r rules/best64.ruleDictionary attack on MD5 with a rule file to mutate each word.
hashcat -m 0 -a 3 hashes.txt ?d?d?d?d?d?d?d?dMask/brute-force attack trying all 8-digit numeric passwords.
hashcat -m 22000 -a 0 wifi.hc22000 rockyou.txtCrack a captured WPA/WPA2 handshake (PMKID/EAPOL format).
hashcat -m 3200 -a 0 bcrypt.txt wordlist.txtAttack bcrypt hashes (slow by design, so keep the wordlist targeted).
hashcat --show -m 1000 hashes.txtDisplay already-cracked hashes from the potfile.
hashcat -bRun a benchmark to see cracking speed per algorithm on your hardware.
Crack only hashes you own or are authorised to test within a defined engagement. Acquiring or cracking others' password hashes without permission is an offence under the IT Act 2000. Recovered passwords are highly sensitive, are often reused elsewhere, and must be stored securely and destroyed at the end of the engagement.
Speed depends heavily on GPU hardware and on the hash algorithm: slow, salted hashes like bcrypt and Argon2 sharply reduce throughput. Long, random passwords remain infeasible to crack. Hashcat only recovers passwords reachable by your wordlist, rules or mask within available time; it guarantees nothing.
| Tool | Pick it when |
|---|---|
| John the Ripper | You want strong CPU cracking, easy hash autodetection and format helpers. |
| Hydra | You are attacking a live login online rather than offline hashes. |
| ophcrack | You want rainbow tables for Windows LM/NTLM with a simple GUI. |
| Cloud GPU (with Hashcat) | You lack local GPUs and need to rent cracking power temporarily. |
| CeWL / custom wordlists | You need to build target-specific wordlists to feed Hashcat. |
Ethical Hacking Course (6 months) — password attacks and hashing module
We are not affiliated with, endorsed by, or a reseller for the vendors of any tool on this site.
Free counselling call. We will tell you honestly whether a full course is worth it for what you actually want to do.
Call +91 75175 72000