Cracking Mode

Incremental / Brute Force Mode

Incremental mode generates all possible character combinations up to a specified length. It is the most thorough attack because it exhaustively tries every permutation, but it is also the slowest by many orders of magnitude.

Use incremental mode only as a last resort after wordlist, single, and rule-based attacks have failed. It is practical for passwords of 6-8 characters using a restricted charset (e.g., lowercase + digits) but infeasible for longer or more complex passwords.

Basic Usage

Default incremental (all printable ASCII)

bash
1john --incremental hashes.txt

Exhaustively tries all 95 printable ASCII characters. Extremely slow beyond 7 characters.

Restrict to lowercase letters and digits

bash
1john --incremental=LowerNum hashes.txt

Limit password length

bash
1john --incremental --max-length=6 hashes.txt

Built-in Incremental Charsets

John ships with several optimized incremental character sets. The charset determines which characters are used at each position.

ASCII

All 95 printable ASCII characters (slowest).

Lower

Lowercase letters only (a-z).

Upper

Uppercase letters only (A-Z).

Alpha

All letters (a-z, A-Z).

LowerNum

Lowercase + 0-9.

UpperNum

Uppercase + 0-9.

Alnum

Letters + digits.

LanMan

Uppercase only; optimized for Windows LM hashes.

Digits

Numbers only (0-9).

Printable

Printable ASCII (default).

Search Space Size Examples

Understanding the combinatorial explosion helps you judge attack feasibility:

CharsetSize6-char combos8-char combos
lowercase (a-z)26308 million208 billion
lower+num361.8 billion2.8 trillion
alpha (a-zA-Z)5219.7 billion53 trillion
alnum6256.8 billion218 trillion
printable ASCII95735 billion6.6 quadrillion

Warning

At 100 million guesses/sec, cracking an 8-character lowercase password takes ~38 minutes. Eight alphanumeric? Over 2 years. Plan cracking sessions accordingly.

When to Use Incremental Mode

1

As Last Resort

After all wordlist, rule, and hybrid attacks fail, try incremental for remaining short passwords.

2

Known Charset

If you know the target uses only digits or lowercase letters, incremental becomes tractable for 6-7 characters.

3

CTF Challenges

Many CTF flags are intentionally weak (5-6 chars) to make incremental feasible for demo purposes.

Optimizing Incremental Speed

Use --fork for CPU parallelism

bash
1john --incremental=LowerNum --fork=8 hashes.txt

Use GPU-accelerated opencl version

bash
1john --incremental:LowerNum --format=md5-opencl hashes.txt

Not all formats have OpenCL variants. Check john --list=formats for those ending in -opencl.

Restrict max length aggressively

bash
1john --incremental --max-length=6 hashes.txt

Tip

For Windows LM hashes, use --incremental=LanMan — it's optimized for the 7-character uppercase limitation of the LM algorithm.
Next: External Mode Back