Supported Hash Formats
John the Ripper Jumbo supports over 400 hash and cipher formats. From classic Unix crypt hashes to modern memory-hard algorithms, from encrypted archives to Windows NTLM — John can crack them all.
When you run john --list=formats, the output lists formats by their kernel name. You specify them with --format=<name>.
Tip
--format can improve speed by selecting a dedicated optimized code path.Common Hash Formats
These are the formats you will encounter most frequently in CTFs, pentests, and real-world engagements:
Traditional DES-based Unix crypt, 13-char, very fast.
$1$salt$hash
Blowfish-based, deliberately slow. Uses $2a$, $2b$, $2y$ prefixes.
$2y$12$salt...
MD5-based crypt ($1$). Still common on legacy systems.
$1$salt$hash
SHA-512-based crypt ($6$). Default on modern Linux.
$6$salt$hash
SHA-256-based crypt ($5$). Intermediate between md5crypt and sha512crypt.
$5$salt$hash
Memory-hard algorithm; better than bcrypt.
$y$j9T$salt...
Memory-hard; designed to thwart GPU/ASIC attacks.
$s0$salt...
Password Hashing Competition winner; very memory-hard.
$argon2i$...
Windows NTLM hash (MD4 of UTF-16LE password).
aad3b435b51404eeaad3b435b51404ee
Legacy Windows LAN Manager; uppercase only, split in half.
299BD128C1101FD6
Bare 32-char hex MD5; no salt.
5d41402abc4b2a76b9719d911017c592
Bare 40-char hex SHA1.
2fd4e1c67a2d28fced849ee1bb76e7391b93eb12
Bare 64-char hex SHA256.
9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
Bare 128-char hex SHA512.
ee26b0dd4af7...
MySQL 4.1+ SHA1(SHA1(password)).
*94BDCEBE19083CE2A1F959...*
Apache $apr1$ MD5.
$apr1$salt$hash
Google credentials hash.
username:google:hash
SSH private key passphrase (RSA/DSA/ECDSA/ED25519).
-----BEGIN OPENSSH PRIVATE KEY-----
ZIP archive password (traditional or AES).
PKZIP encrypted file data
RAR archive password.
RAR!...
PDF document encryption (40/128-bit RC4 or AES).
ownerkey/userkey
MS Office 97-2003 (RC4) and 2007-2016 (AES).
$office$*$...
KeePass 1.x (KDB) and 2.x (KDBX) master key.
$keepass$...
WPA/WPA2 PSK handshake (hccapx format).
WPA PSK handshake capture
Bitcoin wallet passphrase (sha256).
encrypted wallet.dat
Telegram desktop app passphrase (mtp).
tdata folder hash
WhatsApp crypt key.
WhatsApp database key
Listing All Formats
List every supported format
1john --list=formats
Outputs over 400 format names in a comma-separated list.
Pretty-print one per line
1john --list=formats | tr ',' '\n' | less
Count how many formats are supported
1john --list=formats | tr ',' '\n' | wc -l
Filter by substring
1john --list=formats | tr ',' '\n' | grep -i sha
Counting Formats
The John Jumbo build contains hundreds of formats across categories:
Unix crypts
20+ formats
DES, MD5, SHA, yescrypt, argon2, etc.
Windows
10+ formats
NTLM, LM, cached credentials, Syskey.
Documents
15+ formats
PDF, Office, OpenDocument, iWork.
Archives
12+ formats
ZIP, RAR, 7z, TAR with encryption.
Network
8+ formats
WPA/WPA2, WEP, WPAPSK, SSH.
Databases
20+ formats
MySQL, PostgreSQL, Oracle, SQLite.
Applications
50+ formats
KeePass, LastPass, 1Password, Telegram.
Blockchain
5+ formats
Bitcoin, Ethereum, Monero wallet hashes.
Understanding Format Strength
Fast Hashes
SHA1, MD5, NTLM — billions of guesses/sec on GPU. Use wordlists or external patterns.
Moderate Hashes
bcrypt, sha512crypt — tens to hundreds of thousands/sec. Require longer wordlists or rules.
Slow Hashes
scrypt, argon2 — thousands/sec or less. Only feasible with rule-rich wordlists; brute force infeasible.
Warning
Identifying Unknown Formats
If you encounter a hash you do not recognize:
1. Check format manually with --list
1john --list=formats | grep -i 'md5\\|sha'
2. Use online hash identifier tools
hash-identifier, hashid, or online services can suggest format based on prefix and length.
3. Look at hash structure
Patterns: unix crypt starts with $id$; Windows NTLM is 32 hex upper/lower; bcrypt uses $2a$, $2b$, $2y$; salt is usually embedded.
Info