Pro Tips

Always start every cracking session with --single. It uses user metadata (name, GECOS) to generate guesses and is fast enough to try on every hash. Many weak passwords use personal information directly.

Cracking large hash sets can take days. Always save your session with --session=myjob. If interrupted, resume with --restore=myjob instead of starting over.

Combine --wordlist=rockyou.txt --incremental to run dictionary first, then automatically try brute force on remaining hashes. This handles both weak dictionary passwords AND unknown short PINs.

MD5/NTLM: billions/sec with GPU. bcrypt/scrypt/argon2: hundreds or less. Plan time estimates with john --test to benchmark. Slow hashes require longer wordlists + better rules.

Instead of raw rockyou.txt, filter to relevant words: company name, location, products, years. Pre-processing to custom lists gives better hit rate and faster cracking cycle.

--fork=N splits work across N CPU cores. For wordlist mode, fork=4 on a 4-core machine nearly quadruples speed. Benchmark to find sweet spot.

John reads .gz directly: --wordlist=rockyou.txt.gz. This saves disk space without slowing down I/O much.

For external mode or Hashcat-style masks: ?u?u?u?d?d?d for "AAA123" patterns. Not native to John — use external mode or hybrid attacks with rules.

When you know the password structure (e.g., "CompanyYYMMDD!"), write an external mode or use --stdout piping to generate candidates efficiently.

For slow hashes (bcrypt, argon2), disable rules — each guess already costs 100ms+. With wordlists, focus on quality over quantity. For fast hashes, use huge wordlists + Jumbo rules.

Instead of pure incremental, use --rules=Wordlist to append numbers or --rules=Jumbo for permutations. This gives incremental-like coverage with dictionary base.

Sort and deduplicate your hash file: sort hashes.txt | uniq > clean.txt. Prevents redundant work and avoids counting cracked passwords incorrectly.

Run john --test to see guesses/sec for every format on your hardware. This informs whether GPU or CPU paths are better, and whether brute force is feasible.

Memory-hard hashes (scrypt, argon2) run faster with more RAM. Stop other memory-hungry processes to give John full access to system memory during cracking.

Feed several wordlists one after another (multiple --wordlist flags). John exhausts the first before moving to the second. Order by likelihood.

If you crack one hash format, try the same password on other accounts/hashes. Add --users to target specific accounts, or use --show to export results.

Use john --show hashes.txt to list cracked passwords. This also removes them from further attempts. Keep a master cracked.txt list across engagements.

Build John with --enable-opencl for GPU acceleration. Use formats with -opencl suffix (md5-opencl, sha256-opencl). GPU can be 100-1000x faster than CPU.

Use --max-length=N with incremental mode to restrict search space to short passwords you can realistically exhaust.

For named sessions, run john --status=myjob in another terminal to see current rate, elapsed time, and current candidate.