Cracking Mode

Wordlist Mode

Wordlist mode is John's primary attack mode and the most commonly used in real-world engagements. It reads passwords from a wordlist file and tries each one against the target hashes. When combined with rules — powerful transformation engines — wordlist mode multiplies its reach by thousands of mutations per base word.

The quality of your wordlists determines success. Default wordlists include rockyou.txt (Kali), and SecLists provides dozens of specialized lists (domains, companies, common passwords, mangled patterns, etc.).

Basic Usage

Minimal wordlist command

bash

1john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt

Custom wordlist

bash

1john --wordlist=./my_wordlist.txt hashes.txt

Wordlist with incremental fallback

bash

1john --wordlist=rockyou.txt --incremental hashes.txt

Tries the wordlist first, then switches to incremental brute force for remaining hashes.

Common Wordlists

rockyou.txt

14M passwords from RockYou breach — the most popular wordlist.

/usr/share/wordlists/rockyou.txt

SecLists

Massive collection including passwords, usernames, directories, and more.

/usr/share/wordlists/SecLists/

dirb

Directory bruteforce wordlists (also good for passwords).

/usr/share/wordlists/dirb/

custom_top1000.txt

Targeted top passwords based on your target organization/region.

create your own

Warning

rockyou.txt is ~133MB uncompressed and contains 14 million passwords. Ensure you have enough disk space and RAM for large wordlists.

Wordlist Mode Options

Wordlist with rules

bash

1john --wordlist=rockyou.txt --rules=Jumbo hashes.txt

Applies thousands of mutations: case toggles, leet speak substitutions, appending numbers, etc.

Wordlist with specific rule set

bash

1john --wordlist=rockyou.txt --rules=Wordlist hashes.txt

Wordlist rules: moderate mutations like capitalizing first letter, appending 123, 1-3 digit numbers.

Multiple wordlists

bash

1john --wordlist=rockyou.txt --wordlist=common_passwords.txt hashes.txt

John can accept multiple --wordlist flags and tries them sequentially.

Wordlist with custom encoding

bash

1john --wordlist=rockyou.txt --encoding=utf8 hashes.txt

Use --encoding if your wordlist contains non-ASCII characters.

Creating Custom Wordlists

For targeted assessments, create wordlists specific to your target:

Combine multiple sources

bash

1cat company_names.txt product_names.txt important_years.txt > target_wordlist.txt

Generate variations with hashcat-utils or Crunch

bash

1crunch 8 8 -f /usr/share/crunch/charset.lst mixalpha-numeric -o candidates.txt

Tip

Preprocess rockyou.txt: remove duplicates with sort -u, filter to relevant length with awk 'length>=8 && length<=12'

Performance Tips

Use --fork=N for multi-CPU

Utilize multiple cores: --fork=4 spawns 4 processes.

Use OpenCL format variants for GPU

Formats like md5-opencl, sha256-opencl use GPU for massive speedups.

Compress wordlists

John can read gzipped wordlists directly: --wordlist=rockyou.txt.gz.

Disable rules for speed

Runs faster but misses mutations; use --rules=Single for minimal transform set.

Next: Rules Back