John the Ripper (often abbreviated as JtR or simply John) is one of the most popular and powerful password cracking tools in cybersecurity. Originally developed by Openwall for Unix systems, it now runs on 15+ different platforms including Linux, Windows, macOS, and even mobile devices.
Security professionals use John the Ripper for password auditing, penetration testing, and recovering forgotten passwords. It automatically detects hash types, supports hundreds of encryption formats, and uses intelligent cracking techniques to find weak passwords efficiently.
This comprehensive guide covers everything from installation to advanced usage, providing you with the knowledge to conduct professional password security assessments.
Legal Notice: Use John the Ripper only on systems you own or have explicit written authorization to test. Unauthorized password cracking is illegal in most jurisdictions.
What is John the Ripper?
John the Ripper is a free, open-source password cracking tool designed to detect weak passwords. It combines multiple cracking methods in a single package and automatically detects most hash types.
Key Features
Multi-platform support:
Linux, Unix, Windows, macOS
Supports CPUs, GPUs, and even FPGAs
Optimized builds for different processors
Hash type detection:
Automatically identifies hash formats
Supports 200+ hash and cipher types
Includes legacy and modern algorithms
Multiple attack modes:
Dictionary attacks using wordlists
Single crack mode using user information
Incremental brute-force attacks
Rule-based password mutations
Performance optimization:
Multi-threaded processing
GPU acceleration support
Distributed cracking across multiple systems
Common Use Cases
Password security audits:
Testing organizational password policies
Identifying weak user passwords
Validating password complexity requirements
Penetration testing:
Cracking captured password hashes
Testing authentication systems
Demonstrating password vulnerability
Digital forensics:
Recovering encrypted file passwords
Accessing protected archives
Retrieving credentials from seized systems
Credential recovery:
Legitimate password recovery for authorized users
Accessing forgotten passwords on owned systems
Installation
Installing on Kali Linux
John the Ripper comes pre-installed on Kali Linux. Verify installation:
john --version
Update to latest version:
sudo apt update
sudo apt install john
Install Jumbo version (extended feature set):
sudo apt install john-data
Installing on Ubuntu/Debian
sudo apt update
sudo apt install john
Installing on Windows
Download from official site:
https://www.openwall.com/john/
Extract the ZIP file and navigate to the run directory:
cd john-1.9.0-jumbo-1-win64/run
john.exe --version
Building from Source (Advanced)
Clone the repository:
git clone https://github.com/openwall/john
cd john/src
./configure
make -s clean && make -sj4
Test the build:
cd ../run
./john --test
Understanding Password Hashes
Before cracking passwords, you need to understand hashes.
What is a Hash?
A hash is a one-way mathematical function that converts any input into a fixed-length string. Password hashes allow systems to verify passwords without storing them in plaintext.
Common hash types:
MD5:
5f4dcc3b5aa765d61d8327deb882cf99
SHA-1:
5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8
SHA-256:
5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8
NTLM (Windows):
8846F7EAEE8FB117AD06BDD830B7586C
Hash Identification
John can auto-detect most hash types, but manual identification helps:
Identify hash manually:
hash-identifier
Or use online tools:
hashcat.net/wiki/doku.php?id=example_hashes
hashes.com/en/tools/hash_identifier
John the Ripper Cracking Modes
John offers three primary cracking modes, each optimized for different scenarios.
1. Single Crack Mode
Single crack mode is the fastest method. It uses information from the username or GECOS field to generate password candidates based on simple patterns.
When to use:
Users who base passwords on usernames
Quick initial attempt before slower methods
Testing password policies that allow username variants
Example patterns tested:
Username as-is: "john"
Capitalized: "John"
With numbers: "john123", "john2024"
Reversed: "nhoj"
With common suffixes: "john!", "john@123"
2. Dictionary Mode (Wordlist)
Dictionary mode uses pre-compiled lists of common passwords, dictionary words, and previously compromised credentials. This is the most commonly used mode for penetration testing.
When to use:
Testing against common passwords
Using breach databases
Applying password mutation rules
Common wordlists:
rockyou.txt (14 million passwords from breaches)
Probably wordlists by berzerk0
SecLists password collections
Custom organization-specific wordlists
3. Incremental Mode (Brute Force)
Incremental mode tries every possible password combination. It uses character frequency analysis to prioritize likely combinations.
When to use:
Passwords not in dictionaries
Short passwords (under 8 characters)
When dictionary attacks fail
Testing maximum password complexity
Warning: This mode is extremely time-consuming for long passwords. An 8-character password with full alphanumeric and symbols has 218 trillion combinations.
Basic Commands
Cracking Your First Password
Create a test hash file:
echo "user:5f4dcc3b5aa765d61d8327deb882cf99" > hash.txt
This is the MD5 hash of "password".
Run John with auto-detection:
john hash.txt
John automatically detects the hash type and starts cracking.
View cracked passwords:
john --show hash.txt
Output:
user:password
1 password hash cracked, 0 left
Specifying Hash Format
Explicitly tell John the hash format:
john --format=raw-md5 hash.txt
List all supported formats:
john --list=formats
Common formats:
raw-md5
raw-sha1
raw-sha256
nt (Windows NTLM)
bcrypt
descrypt (Unix crypt)
Session Management
Save session state:
John automatically saves progress every 10 minutes to john.rec.
Manually abort and save:
Press Ctrl+C once
Restore interrupted session:
john --restore
Named sessions:
john --session=mysession hash.txt
Restore named session:
john --restore=mysession
Status Monitoring
Check cracking status:
Press any key while John is running
Output shows:
Current password being tested
Passwords tested per second
Percentage complete
Estimated time remaining
Single Crack Mode Usage
Basic Single Mode
john --single hash.txt
Single Mode with Format
john --single --format=raw-sha1 hash.txt
How Single Mode Works
Given username "admin" and hash, John tries:
admin
Admin
ADMIN
admin123
admin2024
admin!
nimda (reversed)
adm1n (leetspeak)
Example with real hash:
Create test file:
echo "admin:d033e22ae348aeb5660fc2140aec35850c4da997" > single.txt
This is SHA-1 hash of "admin".
Run single mode:
john --single --format=raw-sha1 single.txt
Result:
admin (admin)
Dictionary Mode Usage
Basic Dictionary Attack
john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt
Dictionary Mode with Format
john --wordlist=/usr/share/wordlists/rockyou.txt --format=raw-md5 hash.txt
Custom Wordlist
Create custom wordlist:
echo "password" > custom.txt
echo "admin123" >> custom.txt
echo "welcome" >> custom.txt
echo "P@ssw0rd" >> custom.txt
Use custom wordlist:
john --wordlist=custom.txt hash.txt
Standard Wordlist Locations
Kali Linux wordlists:
/usr/share/wordlists/rockyou.txt
/usr/share/wordlists/fasttrack.txt
/usr/share/seclists/Passwords/
Extract rockyou.txt (if compressed):
sudo gunzip /usr/share/wordlists/rockyou.txt.gz
Dictionary with Rules
Apply password mutation rules:
john --wordlist=wordlist.txt --rules hash.txt
This applies transformations like:
Capitalization changes
Number additions
Special character substitutions
Leetspeak conversions
Rule-Based Cracking
Rules transform dictionary words to create password candidates.
Common Rule Sets
List available rule sets:
john --list=rules
Use specific rule set:
john --wordlist=wordlist.txt --rules=best64 hash.txt
Popular rule sets:
best64: Optimized 64 best rules
jumbo: Large comprehensive ruleset
single: Rules for single mode
wordlist: Standard wordlist rules
Rule Examples
John rules modify words systematically.
Example rules:
: (no change) → password
c (capitalize) → Password
u (uppercase all) → PASSWORD
l (lowercase all) → password
$1 (append 1) → password1
^1 (prepend 1) → 1password
r (reverse) → drowssap
Combine rules:
c$1 → Password1
u$!$! → PASSWORD!!
Creating Custom Rules
Edit John configuration:
sudo nano /etc/john/john.conf
Add custom rule section:
[List.Rules:Custom]
c$2$0$2$4
c$2$0$2$5
c$!$!
u$1$2$3
Use custom rules:
john --wordlist=wordlist.txt --rules=Custom hash.txt
Incremental Mode Usage
Basic Incremental Mode
john --incremental hash.txt
Incremental with Character Set
Digits only (0-9):
john --incremental=digits hash.txt
Lowercase alpha:
john --incremental=lower hash.txt
Alphanumeric:
john --incremental=alnum hash.txt
Full ASCII:
john --incremental=ascii hash.txt
Custom Incremental Mode
Define minimum and maximum length:
Edit john.conf and create custom charset:
[Incremental:Custom]
File = $JOHN/alpha.chr
MinLen = 6
MaxLen = 8
CharCount = 26
Use custom incremental:
john --incremental=Custom hash.txt
Performance Considerations
Incremental mode time estimates:
4 characters (lowercase): Seconds 6 characters (lowercase): Minutes 8 characters (lowercase): Hours 8 characters (alphanumeric): Days 10 characters (full): Years
Use incremental mode strategically:
Start with short length limits
Use targeted character sets
Run on powerful hardware
Consider distributed cracking
Hash Extraction Techniques
Before cracking, you need to extract hashes from systems and files.
Linux Password Hashes
Extract from /etc/shadow:
sudo unshadow /etc/passwd /etc/shadow > linux_hashes.txt
Then crack:
john linux_hashes.txt
Windows Password Hashes
Extract with pwdump or fgdump on Windows:
fgdump.exe
Extract with Mimikatz:
privilege::debug
sekurlsa::logonpasswords
Crack NTLM hashes:
john --format=nt windows_hashes.txt
ZIP File Passwords
Extract ZIP hash:
zip2john encrypted.zip > zip_hash.txt
Crack ZIP password:
john zip_hash.txt
RAR File Passwords
Extract RAR hash:
rar2john encrypted.rar > rar_hash.txt
Crack RAR password:
john rar_hash.txt
PDF File Passwords
Extract PDF hash:
pdf2john encrypted.pdf > pdf_hash.txt
Crack PDF password:
john pdf_hash.txt
SSH Private Key Passphrases
Extract SSH key hash:
ssh2john id_rsa > ssh_hash.txt
Crack SSH passphrase:
john ssh_hash.txt
Office Document Passwords
Extract Word/Excel hash:
office2john document.docx > office_hash.txt
Crack Office password:
john office_hash.txt
MySQL Database Passwords
Extract from MySQL dump:
mysql -u root -p -e "SELECT user, password FROM mysql.user" > mysql_hashes.txt
Crack MySQL hashes:
john --format=mysql-sha1 mysql_hashes.txt
Advanced Techniques
Mask Attack
Specify password pattern:
john --mask='?u?l?l?l?l?d?d?d' hash.txt
Mask characters:
?l lowercase letter
?u uppercase letter
?d digit
?s special character
?a any printable character
Example masks:
?u?l?l?l?l?d?d → "Admin23"
?d?d?d?d-?d?d-?d?d → "1990-01-15"
?u?l?l?l?d?d! → "Pass25!"
Hybrid Attack
Combine wordlist with mask:
john --wordlist=names.txt --mask='?w?d?d?d' hash.txt
This appends digits to each word:
john → john123, john456
admin → admin999, admin777
Markov Mode
Uses statistical analysis of password patterns:
john --markov hash.txt
Markov mode learns from password patterns and generates candidates based on character sequence probability.
External Mode
Write custom cracking logic in C:
Edit john.conf:
[List.External:Custom]
void init()
{
word[0] = 'a';
word [jumpcloud](https://jumpcloud.com/it-index/what-is-john-the-ripper) = 0;
}
void generate()
{
word[0]++;
if (word[0] > 'z')
word[0] = 'a';
}
Use external mode:
john --external=Custom hash.txt
GPU Acceleration
Check GPU support:
john --list=opencl-devices
Use GPU for cracking:
john --format=raw-sha256-opencl hash.txt
GPU cracking can be 50-100x faster than CPU for some hash types.
Practical Examples
Example 1: Cracking MD5 Hashes
Create test hashes:
echo "user1:5f4dcc3b5aa765d61d8327deb882cf99" > test.txt
echo "user2:098f6bcd4621d373cade4e832627b4f6" >> test.txt
These are MD5 hashes of "password" and "test".
Crack with dictionary:
john --format=raw-md5 --wordlist=/usr/share/wordlists/rockyou.txt test.txt
View results:
john --show test.txt
Example 2: Cracking Linux Passwords
Create test shadow entry:
testuser:$6$rounds=656000$salt$hash:18000:0:99999:7:::
Crack with rules:
john --wordlist=/usr/share/wordlists/rockyou.txt --rules linux_shadow.txt
Example 3: Cracking ZIP Archive
Create password-protected ZIP:
zip -e secret.zip document.txt
Enter password when prompted.
Extract hash:
zip2john secret.zip > zip_hash.txt
Crack password:
john --wordlist=/usr/share/wordlists/rockyou.txt zip_hash.txt
Retrieve password:
john --show zip_hash.txt
Example 4: Cracking SSH Private Key
Generate encrypted SSH key:
ssh-keygen -t rsa -b 2048
Enter passphrase when prompted.
Extract hash:
ssh2john id_rsa > ssh_hash.txt
Crack passphrase:
john --wordlist=custom_wordlist.txt ssh_hash.txt
Example 5: Multi-Format Batch Cracking
Create mixed hash file:
user1:5f4dcc3b5aa765d61d8327deb882cf99:MD5
user2:5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8:SHA1
user3:$1$salt$hash:MD5-CRYPT
John auto-detects each format:
john --wordlist=/usr/share/wordlists/rockyou.txt mixed.txt
Performance Optimization
Multi-Core Processing
Use all CPU cores:
john --fork=4 hash.txt
Replace 4 with your CPU core count.
Limit Password Length
Speed up by limiting tested length:
john --min-length=8 --max-length=12 hash.txt
Use Faster Hash Formats
When testing policies, use faster hashes:
MD5: Very fast
SHA-1: Fast
bcrypt: Very slow (intentional)
Distributed Cracking
Split wordlist across machines:
Machine 1:
john --wordlist=rockyou.txt --rules --node=1/4 hash.txt
Machine 2:
john --wordlist=rockyou.txt --rules --node=2/4 hash.txt
Repeat for nodes 3 and 4.
Session Optimization
Disable session saving for speed:
john --no-log hash.txt
Use memory-mapped files:
john --mem-file-size=1024 hash.txt
Best Practices
Password Audit Methodology
Gather authorization
Written permission from management
Clear scope definition
Data handling agreements
Extract hashes securely
Use secure channels
Encrypt hash files
Limit access to hash data
Start with fast methods
Single mode first (seconds)
Dictionary attack next (minutes)
Rules-based after (hours)
Incremental last resort (days)
Document findings
Number of weak passwords
Common patterns observed
Policy violations identified
Remediation recommendations
Secure cleanup
Securely delete hash files
Remove cracked passwords
Clear session data
Archive results securely
Wordlist Management
Build effective wordlists:
Include organization-specific terms
Add previous breach data
Use industry terminology
Include location-based words
Add seasonal terms
Wordlist sources:
SecLists collection
Have I Been Pwned database
Weakpass project
CrackStation wordlist
Custom OSINT gathering
Rule Development
Create custom rules for target:
Local sports teams
Company name variations
Local area codes
Common date formats
Keyboard patterns
Test rule effectiveness:
john --stdout --wordlist=test.txt --rules=custom | head -20
This shows what passwords the rules generate.
Legal and Ethical Considerations
Only test authorized systems:
Written consent required
Clear scope boundaries
Documented authorization chain
Protect discovered credentials:
Encrypt storage
Limit access
Secure communications
Defined retention policy
Report responsibly:
Document methodology
Provide evidence
Recommend fixes
Follow disclosure timeline
Troubleshooting
Common Issues
John not detecting hash type:
john --list=formats | grep -i md5
john --format=raw-md5 hash.txt
No password file specified:
john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt
Session already running:
rm ~/.john/john.rec
john hash.txt
Wordlist not found:
ls -la /usr/share/wordlists/
sudo gunzip /usr/share/wordlists/rockyou.txt.gz
Out of memory:
john --mem-file-size=512 hash.txt
Performance Issues
Slow cracking speed:
Check CPU usage
Verify hash format is correct
Use GPU acceleration
Reduce password length range
Use faster cracking mode first
No progress shown:
Press any key for status
Check john.rec for saves
Verify process is running
Key Takeaways
John the Ripper is the industry standard for password cracking and security auditing. Mastering this tool is essential for penetration testers and security professionals.
Start with fast methods first. Single mode and dictionary attacks crack most weak passwords quickly. Save incremental mode for last.
Use appropriate wordlists. Generic wordlists work for testing, but custom wordlists targeting specific organizations are far more effective.
Apply rules intelligently. Rule-based mutations dramatically increase wordlist effectiveness without massive file sizes.
Understand hash types. Different algorithms have different cracking speeds. Know what you're testing.
Practice legally and ethically. Only crack passwords on systems you own or have explicit written authorization to test.
Document everything. Professional password audits require comprehensive documentation of methodology, findings, and recommendations.
Combine tools strategically. John works best alongside Hashcat, Hydra, and other specialized tools for complete security assessments.
Connect With Me
Sign up FREE for my web app
YouTube: @cyberhawkconsultancy | @cyberhawkk
TikTok: @cyberhawkthreatintel
X: @cyberhawkintel
Telegram: @cyberhawkthreatintel
Hashtags: #cyberhawktheatintel #cyberhawkconsultancy #cyberhawkk