Advanced Cracking

Rules

Rules are John's mutation engine. They transform every word in your wordlist by applying character-level operations — uppercase/lowercase changes, leet speak substitutions, appending/prepending, reversing, doubling characters, and hundreds more. One word can become thousands of candidates.

With a 100k-word list, Jumbo rules generate hundreds of millions of password guesses without you having to pre-generate a massive wordlist file.

Built-in Rule Sets

John ships with several rule sets from mild to aggressive:

Rule Set	Speed	Mutations	Best For
None	Fastest	0 per word	Baseline, very fast dictionary check.
Single	Fast	~10 per word	First expansion beyond raw wordlist.
Wordlist	Medium	~100-500 per word	General-purpose for most real-world passwords.
Extra	Medium-Slow	~500-2000 per word	When Wordlist yields few results; office/social passwords.
Jumbo	Slow	2000+ per word	Finally go for broke — catch everything before incremental.

Using Rules

Wordlist mode with Jumbo rules

bash

1john --wordlist=rockyou.txt --rules=Jumbo hashes.txt

Applies the most aggressive rule set. Expect ~100-500x expansion depending on the wordlist size.

Wordlist-only (no rules)

bash

1john --wordlist=rockyou.txt hashes.txt

Single mode with rules

bash

1john --single --rules=Wordlist hashes.txt

Single mode generates usernames first and then applies rules to mutate each candidate.

Combine wordlist + incremental fallback

bash

1john --wordlist=rockyou.txt --rules=Extra --incremental hashes.txt

How Much Expansion?

Rule expansion multiplies each base word into many candidate passwords. Here is an example for typical rule sets applied to the word password:

Rule: Single → ~20 variations

Password, Password1, password, p@ssword, 123password, ...

Rule: Wordlist → ~300 variations

Password123, Password!, Passw0rd, p@ssw0rd123, ...

Rule: Extra → ~1500 variations

P@ssW0rd!, p@$$w0rd, pass WORD, ...

Rule: Jumbo → ~3000+ variations

Extensive permutations including double chars, vowel swaps, sandwich patterns.

Tip

Multiply the number of source words by average rule-generated per word to estimate total guess count. rockyou.txt (14M) × 3000 Jumbo rules → ~42B guesses — plan your cracking sessions accordingly.

Custom Rules

You can write your own rule files if built-in sets are not enough. Create a plain text file where each line describes a sequence of operations.

Example custom.rules:

# Append two digits at end (200 variants: 00-99)
?d?d

# Prepend common prefix
Company_?l?l?l

# Leet substitutions
a @
e 3
i 1
o 0
s $

# Capitalize first and append year
Az?y?y?y?y

# Duplicate last character
A

Use a custom rules file

bash

1john --wordlist=rockyou.txt --rules=custom.rules hashes.txt

Warning

Rule syntax is powerful but precise. The John documentation (doc/RULES in the source tree) explains every operation. Write a small test wordlist to validate your rules.

Performance Impact

Rules increase coverage at the cost of time. Estimate your throughput:

Wordlist only

100M p/s — Baseline speed

Wordlist + Single

30-50M p/s — 3-5x slower

Wordlist + Wordlist

5-15M p/s — 10-20x slower

Wordlist + Jumbo

0.5-2M p/s — 100-200x slower

Info

Use --status to see current guesses/sec. Adjust rules to fit your time budget.

Next: Hash Extraction Back