Hydra (THC-Hydra) is a fast, open-source online password-cracking tool. Unlike offline crackers, it attacks live network services by trying many username and password combinations against a login. It supports dozens of protocols, including SSH, FTP, RDP, SMB, HTTP form logins, MySQL and more. Security auditors use it to test whether services accept weak or default credentials and whether accounts are protected against brute-force attacks.
Last updated: 6 August 2026
Hydra automates credential guessing against a running service. An auditor tests an internal SSH server with a known username and a password list to check for weak passwords, or throws a small list of default credentials at an admin panel to confirm the login is hardened. It handles HTTP POST/GET form logins, basic auth and many binary protocols, with tunable parallelism. It is an online attack tool: speed is limited by the target and by lockout policies, so it is best for spotting weak or default credentials, not exhaustive cracking.
Linux · Windows · macOS · BSD
Open source (AGPLv3 with OpenSSL exception)
hydra -l admin -P passwords.txt 10.10.10.5 sshTry one username against a password list on SSH.
hydra -L users.txt -P passwords.txt 10.10.10.5 sshIterate through both a username list and a password list.
hydra -l admin -P passwords.txt ftp://10.10.10.5Attack an FTP login using the URL-style target syntax.
hydra -l admin -P passwords.txt 10.10.10.5 -t 4 -fLimit to 4 parallel tasks and stop at the first valid pair.
hydra -l admin -P rockyou.txt 10.10.10.5 http-post-form "/login:user=^USER^&pass=^PASS^:Invalid"Brute-force a web form, matching the failure string to detect success.
hydra -l admin -P passwords.txt rdp://10.10.10.5Test Remote Desktop credentials.
Online brute-forcing generates real login attempts, so run Hydra only against services you own or are explicitly authorised to test. Unauthorised credential attacks are an offence under the IT Act 2000 and can lock out real users or trigger incident response. Always confirm scope, lockout policies and permission in writing beforehand.
As an online attack it is slow and noisy: account lockouts, rate limiting, CAPTCHAs and MFA can stop it entirely, and every attempt is logged. It is best for finding weak or default passwords, not for cracking strong ones. Misconfigured form modules produce false results, so verify any hit manually.
| Tool | Pick it when |
|---|---|
| Medusa | You want a similar parallel online brute-forcer with a different module set. |
| Ncrafty / Ncrack | You want a network authentication cracker from the Nmap project tuned for reliability. |
| Patator | You need a flexible, scriptable brute-forcer with fine-grained response filtering. |
| CrackMapExec / NetExec | You are spraying credentials across Windows/AD networks specifically. |
| John / Hashcat | You already have the hashes and can crack them offline far faster. |
Ethical Hacking Course (6 months) — authentication attacks module
We are not affiliated with, endorsed by, or a reseller for the vendors of any tool on this site.
Free counselling call. We will tell you honestly whether a full course is worth it for what you actually want to do.
Call +91 75175 72000