Hashcat Cheat Sheet: Every Command and Flag (Interactive)

This is the hashcat reference I actually keep open while cracking. Set your hash file, wordlist, mode, and mask once at the top, and every command below rewrites itself with your values so you can copy and run it. Under that is the full flag reference grouped by what you are trying to do, the mask charset table, and the common -m modes. New to the tool? Start with how to use hashcat. Everything here was verified on hashcat 7.1.2.

Set your values once

Try it with your own values

Set these once. Every command below picks up your values, and clearing a field drops it from the commands so you can copy exactly what you mean to run. Hash mode and mask are searchable: type to filter, or pick from the list. Hash mode covers all 581 of hashcat’s modes; for a mask, type your own or choose a common one.

Hash file

Hash mode (-m)

Mask

Workload (-w)

Wordlists

hashcat reads several dictionaries in order. Add as many as you like.

Rule files

Each rule file becomes its own -r. A bare name resolves under rules/; a path is used as-is.

Optional flags (appear only when set)

--session-o output file

Ready-to-run attack commands

Dictionary attack (your default first move). Hash every word in the wordlist:

bash

hashcat -m 0 -a 0 hashes.txt rockyou.txt -w 3

Dictionary + rules (the highest-yield real attack). Mutate each word with a rules file. Add more than one rule file and each becomes its own -r; clear them all and the -r drops away:

bash

hashcat -m 0 -a 0 hashes.txt rockyou.txt -r rules/best66.rule -w 3

Mask attack (smart brute force). Try every string matching the mask. Turn on --increment above to also try shorter lengths:

bash

hashcat -m 0 -a 3 hashes.txt '?u?l?l?l?l?d?d?d' -w 3

Hybrid: wordlist + mask (the password123 pattern, a word then your mask as a suffix):

bash

hashcat -m 0 -a 6 hashes.txt rockyou.txt '?u?l?l?l?l?d?d?d' -w 3

Hybrid: mask + wordlist (your mask as a brute-forced prefix, then a word):

bash

hashcat -m 0 -a 7 hashes.txt '?u?l?l?l?l?d?d?d' rockyou.txt -w 3

Combination attack (every word in your first list joined to every word in the second). Add a second wordlist above to use a different right-hand list:

bash

hashcat -m 0 -a 1 hashes.txt rockyou.txt rockyou.txt -w 3

Show what you have cracked (read results from the potfile):

bash

hashcat -m 0 hashes.txt --show

Benchmark this hash mode (raw speed on your hardware):

bash

hashcat -b -m 0

The full flag reference

Grouped by what you are actually doing. Copy and adapt.

Hashcat Flag Reference

Every flag organised by task. Tested on hashcat 7.1.2.

Core / required

-m 1000Hash mode. Which algorithm produced the hash. 0=MD5, 1000=NTLM, 3200=bcrypt, 22000=WPA. Run --example-hashes for the full list.

-a 0Attack mode. 0=dictionary, 1=combination, 3=mask, 6/7=hybrid, 9=association.

--identify hashes.txtHave hashcat guess the hash mode(s) for the input. New in hashcat 7.

--versionPrint the version. Always state it when reporting.

-IList compute devices and backends (is hashcat using your GPU?).

-b -m 0Benchmark a hash mode for raw speed on your hardware.

Hash & input

hashes.txtFile of hashes, one per line. Pass as the first positional argument after the flags.

--usernameInput lines are username:hash. Strips the username before cracking.

-hhShow all supported hash-modes with names (-h is the short help).

--hex-saltSalt is given in hex.

--keep-guessingKeep cracking after a hash is found (collisions, plaintext variants).

Attack modes

-a 0 wordlist.txtStraight / dictionary. Hash each line of the wordlist.

-a 1 left.txt right.txtCombination. Concatenate every word in left with every word in right.

-a 3 ?u?l?l?l?d?dMask / brute force. Try every string matching the mask.

-a 6 wordlist.txt ?d?d?dHybrid wordlist + mask. Append a brute-forced suffix to each word.

-a 7 ?d?d?d wordlist.txtHybrid mask + wordlist. Prepend a brute-forced prefix to each word.

-a 9Association. One candidate per hash from a per-user hint (username, old password).

Mask & charsets

?l ?u ?d ?s ?aBuilt-in charsets: lower, upper, digit, special, all. ?h/?H are hex.

-1 ?l?dDefine custom charset 1. Reference it in the mask as ?1. Up to -8.

--incrementIncrement mask length from 1 up to the mask length. Try short passwords first.

--increment-min 4 --increment-max 8Bound the incremented length range.

-a 3 password?d?d?dMasks can mix literals and tokens. Cracks password000..password999.

Rules & wordlist mangling

-r rules/best66.ruleApply a rules file to mutate each wordlist word. best66 is the standard starting point.

-r rules/best66.rule -r rules/toggles1.ruleStack multiple rule files (rules are combined, multiplying candidates).

-j 'c'Single rule applied to the left wordlist (combination/hybrid).

-k '$1'Single rule applied to the right wordlist (combination/hybrid).

--loopbackFeed cracked passwords back as a wordlist (catches password reuse patterns).

Performance & tuning

-w 3Workload profile. 1=low (desktop in use), 2=default, 3=high, 4=nightmare (headless).

-OOptimised kernels: much faster, but caps password length. Drop it for long candidates.

-D 1 / -D 2Force CPU (1) or GPU (2) device types.

-SSlower-candidate mode that helps for very slow hashes like bcrypt.

-d 1Use only device number 1 (multi-GPU selection).

--hwmon-temp-abort=90Abort if a device passes 90C. Sanity guard on a hot rig.

Output, session & resume

--showPrint already-cracked hashes for the input file (reads the potfile).

--leftPrint the hashes still NOT cracked.

-o cracked.txtWrite cracked results to a file.

--outfile-format 2Output format: 2 is plaintext only. Combine with -o.

--potfile-disableDo not read or write the potfile (clean experiments).

--session=audit1Name the session so you can resume it.

--restoreResume an interrupted session by name.

Mask charset table (the regex of cracking)

A mask is a pattern, one token per character position. These are the built-in charsets, verified against hashcat --help:

Token	Expands to	Set
`?l`	`abcdefghijklmnopqrstuvwxyz`	lowercase
`?u`	`ABCDEFGHIJKLMNOPQRSTUVWXYZ`	uppercase
`?d`	`0123456789`	digits
`?h`	`0123456789abcdef`	lowercase hex
`?H`	`0123456789ABCDEF`	uppercase hex
`?s`	space plus all keyboard punctuation (shown below)	special
`?a`	`?l?u?d?s`	all printable ASCII
`?b`	byte `0x00` to `0xff`	every byte

The ?s special set, exactly as hashcat defines it (a leading space, then):

text

 !"#$%&'()*+,-./:;<=>?@[\]^_`{|}~

Custom charsets with -1 through -8, then reference them as ?1..?8:

Example	Meaning
`-1 ?l?u ?1?1?1?1?1?1`	six chars, each a mixed-case letter
`-1 ?l?d -2 ?u ?2?1?1?1?1?d?d`	one upper, four lower-or-digit, two digits
`password?d?d?d`	literal `password` then 000 to 999
`--increment ?a?a?a?a?a?a?a?a`	all-printable, length 1 up to 8

The full mask strategy, including keyspace maths, is in the hashcat mask attack.

Common hash modes (`-m`)

A quick lookup for the modes you will reach for. The complete list is hashcat --example-hashes.

Algorithm	`-m`	Speed	Crack guide
MD5	0	Fast	Crack MD5
SHA-1	100	Fast
SHA-256	1400	Fast
NTLM	1000	Fast	Crack NTLM
NetNTLMv2	5600	Fast
Kerberos AS-REP / TGS-REP	18200 / 13100	Fast
md5crypt $1$	500	Slow
sha256crypt $5$	7400	Slow
sha512crypt $6$ (Linux)	1800	Slow
bcrypt $2*$	3200	Slow	Crack bcrypt
Argon2 (i/d/id)	34000	Slow
WPA (PMKID+EAPOL)	22000	Slow	Crack WPA2
KeePass	13400	Slow
MS Office 2013	9600	Slow	Crack files
7-Zip / RAR5	11600 / 13000	Slow	Crack files

Where to go next

The other half of the toolkit: John the Ripper cheat sheet.
Pick the right attack: dictionary vs brute force vs mask vs hybrid.
The two techniques that do the most work: rules and wordlists.
Faster: hashcat optimisation.
The full picture: how password cracking works.

hashcat -m <mode> -a <attack> <hashfile> <wordlist-or-mask> [options]. The two numbers that matter most are -m (which algorithm) and -a (which attack). Set your values in the panel above and the commands fill themselves in.

Run hashcat --identify hashes.txt to have hashcat guess, or hashcat --example-hashes to browse every mode with an example. See how to identify a hash type for the full method.

Use -w 3 (high) on a machine dedicated to cracking, -w 4 on a headless rig you do not touch, and -w 1 on a desktop you are actively using so it stays responsive. Default is -w 2.

Start with --session=name, and if it stops, resume with hashcat --session=name --restore. hashcat checkpoints the keyspace position, so you continue where you left off rather than starting over.

Hashcat Cheat Sheet: Build the Command, Copy, Crack

Set your values once

Ready-to-run attack commands

The full flag reference

Hashcat Flag Reference

Core / required

Hash & input

Attack modes

Mask & charsets

Rules & wordlist mangling

Performance & tuning

Output, session & resume

Mask charset table (the regex of cracking)

Common hash modes (`-m`)

Where to go next

Sources

Ishan Karunaratne

Related posts

SSH Cheat Sheet: Connect, Tunnel, Copy, and ssh-keygen Quick Reference

docker run Cheat Sheet: Flags and Common Patterns

curl Cheat Sheet: HTTP Requests, Headers, Auth, and Common Flags

Hashcat Flag Reference

Core / required

Hash & input

Attack modes

Mask & charsets

Rules & wordlist mangling

Performance & tuning

Output, session & resume

What is the basic hashcat command structure?

How do I find the right -m mode for my hash?

What is the best hashcat workload profile?

How do I resume an interrupted hashcat session?

Sources

Ishan Karunaratne