John the Ripper is a fast, open-source password-cracking tool used to test the strength of password hashes. Given a file of hashes, it attempts to recover the plaintext passwords using dictionary, rule-based, incremental (brute-force) and mask attacks. Its community jumbo edition supports hundreds of hash and file formats. Security teams and auditors use it to find weak passwords before attackers do; it runs primarily on CPU.
Last updated: 6 August 2026
John is used to audit password strength: extract hashes from a system, then see how many John can crack and how quickly. An auditor runs unshadow on a Linux box to combine passwd and shadow files, then cracks the result against a wordlist to flag users with weak passwords. Helper tools like zip2john, rar2john and ssh2john turn encrypted files and keys into crackable hashes. It excels at CPU-based cracking and rule mangling, and is a staple in CTFs and internal password audits.
Linux · Windows · macOS · BSD
Open source (GNU GPLv2); community-enhanced jumbo build
john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txtRun a straight dictionary attack against a hash file.
unshadow /etc/passwd /etc/shadow > mypasswd.txtMerge Linux passwd and shadow files into a crackable format.
john --format=raw-md5 hashes.txtForce a specific hash format when autodetection is ambiguous.
john --wordlist=rockyou.txt --rules hashes.txtApply mangling rules to a wordlist to generate variations.
zip2john protected.zip > zip.hashExtract a crackable hash from a password-protected ZIP file.
john --show hashes.txtDisplay passwords already cracked and stored for this hash file.
john --incremental hashes.txtRun pure brute-force mode when wordlists are exhausted.
Only crack hashes you are authorised to test, such as your own systems or hashes provided within a scoped engagement. Obtaining or cracking other people's password hashes without authorisation is an offence under the IT Act 2000. Handle recovered credentials as sensitive data and destroy them when the engagement ends.
John is primarily CPU-bound, so it is much slower than GPU tools like Hashcat for large or slow hashes. Strong, long, random passwords and heavy algorithms (bcrypt, Argon2) may be infeasible to crack. It only recovers passwords weak enough to appear in a wordlist or reachable by brute force in available time.
| Tool | Pick it when |
|---|---|
| Hashcat | You want GPU-accelerated cracking for far higher speed on large hash sets. |
| Hydra | You are attacking a live network login rather than offline hashes. |
| Cain (legacy) | You are working in older Windows environments (largely superseded now). |
| ophcrack | You want rainbow-table cracking of Windows LM/NTLM hashes with a GUI. |
| CeWL + rules | You need to build a custom wordlist from a target's own website first. |
Ethical Hacking Course (6 months) — password attacks and hashing module
We are not affiliated with, endorsed by, or a reseller for the vendors of any tool on this site.
Free counselling call. We will tell you honestly whether a full course is worth it for what you actually want to do.
Call +91 75175 72000