Password Cracking

John the Ripper

John the Ripper (JtR) is an open-source password security auditing and recovery tool. It supports hundreds of hash and cipher types — from Unix crypt to Windows NTLM, from PDF and Office documents to ZIP and RAR archives — and combines multiple cracking modes with powerful rule-based wordlist mutations.

John is the standard tool for password cracking in cybersecurity assessments, penetration tests, and CTF challenges. Its Jumbo variant includes GPU acceleration via OpenCL and a vast library of format modules.

Module Sections

Installation

Install John the Ripper on Linux, macOS, Windows, or build from source with Jumbo patches.

Single Crack Mode

Uses login name, GECOS, and full name fields to generate candidate passwords. Fast and often surprisingly effective.

Wordlist Mode

Tries passwords from a wordlist file. The most common cracking method, enhanced with rules for mutations.

Incremental / Brute Force

Generates all possible character combinations. Slowest but most thorough method for short passwords.

External Mode

Plug in custom password generation logic written in a C-like scripting language. For advanced attack scenarios.

Hash Formats

Comprehensive reference of supported hash types: Unix crypts, Windows NTLM, documents, archives, and more.

Rules

Mutate wordlist entries with case changes, leet speak, appending/prepending, and thousands of transformations.

Hash Extraction

Extract password hashes from files: zip2john, rar2john, pdf2john, ssh2john, keepass2john, and more.

Command Builder

Interactive tool to select options, configure sessions, and generate optimized John commands.

Examples

Real-world cracking scenarios and the exact commands for each situation.

Pro Tips

Expert advice on session management, performance tuning, format-specific optimization, and brute forcing strategies.

John the Ripper Quiz

Test your password cracking knowledge with 20 multiple-choice questions covering modes, formats, and usage.

John the Ripper Lab

Hands-on exercises where you write John commands to crack different hash types using various modes and options.

Quick Start

Info

Before cracking any password hash, ensure you have legal authorization. Only test systems you own or have explicit permission to audit.