The John the Ripper reference I keep open while working a file. Set your hash file, wordlist, and format once, and every command rewrites itself with your values, ready to copy. Below that is the full flag reference, the *2john extractor list, and the common formats. New to John? Start with the John the Ripper guide . Everything here was verified on John the Ripper 1.9.0-jumbo-1 (the jumbo build).
Authorisation required
Use these techniques only on systems you own or have written authorisation to test. Unauthorised access to a computer system is a crime in nearly every jurisdiction (US: Computer Fraud and Abuse Act. UK: Computer Misuse Act 1990. EU: Directive 2013/40/EU). This article assumes a sanctioned engagement or a lab environment you control. If you do not have permission, do not run these commands against anything you find on the internet.
Reset Set these once. Every command picks up your values. John usually auto-detects the format, so you only need to set it when forcing a specific type.
If you are cracking an encrypted file, turn it into a hash first with the matching *2john tool, then point John at the output:
zip2john secret.zip > :hashfile # then crack :hashfile belowSwap zip2john for the tool that matches your file: rar2john, pdf2john.pl, office2john.py, keepass2john, ssh2john. The full list is in the extractor table further down. Raw database hashes (MD5, NTLM, bcrypt) skip this step, they go straight into the hash file.
Auto-detect and crack (John guesses the format from the hash):
john --wordlist=:wordlist :hashfileForce the format + wordlist (when auto-detect is ambiguous):
john --format=:format --wordlist=:wordlist :hashfileWordlist + rules (mangle each word, the highest-yield attack):
john --format=:format --wordlist=:wordlist --rules :hashfileSingle crack mode (build guesses from the username, run this first):
john --single --format=:format :hashfileIncremental (John's statistics-driven brute force, bound the length):
john --incremental --max-length=8 :hashfileMask attack (targeted brute force when you know the shape):
john --format=:format --mask=:mask :hashfileUse all your CPU cores (split the job with fork):
john --fork=:fork --format=:format --wordlist=:wordlist :hashfileShow what you have cracked (read results from the pot file):
john --show --format=:format :hashfileJohn the Ripper Flag Reference Every flag organised by task. Jumbo build, tested on 1.9.0-jumbo-1.
Core & detection john hash.txtWith no mode flag, John runs single, then wordlist, then incremental automatically.
--format=raw-md5Force a hash format. Needed when auto-detect is ambiguous. See --list=formats.
--list=formatsList every supported format (hundreds in jumbo).
--list=build-infoShow the build and version. Confirm you have jumbo.
--testSelf-test and benchmark the formats.
--show hash.txtPrint cracked passwords as username:password. Add =left for the uncracked ones.
Extract hashes from files (*2john) zip2john file.zip > hash.txtEncrypted ZIP (PKZIP and WinZip/AES).
rar2john file.rar > hash.txtRAR3 and RAR5 archives.
7z2john.pl file.7z > hash.txt7-Zip archives.
pdf2john.pl file.pdf > hash.txtPassword-protected PDF.
office2john.py file.docx > hash.txtWord, Excel, PowerPoint (2007 onward).
keepass2john file.kdbx > hash.txtKeePass database master password.
ssh2john id_rsa > hash.txtPassphrase on an encrypted SSH private key.
gpg2john secret.gpg > hash.txtGnuPG symmetric / private key passphrase.
Cracking modes --singleSingle crack: builds candidates from the username/GECOS. Fast, run first.
--wordlist=rockyou.txtWordlist (dictionary) mode.
--wordlist=rockyou.txt --rulesWordlist with word-mangling rules. The highest-yield attack.
--rules=JumboUse a named rules section. Jumbo is the big built-in set.
--incrementalStatistics-driven brute force. Bound with --max-length.
--mask=?u?l?l?l?d?dMask mode: targeted brute force by pattern.
--loopbackUse already-cracked passwords as the wordlist (reuse patterns).
Scope & performance --fork=4Split work across 4 processes (CPU cores).
--max-length=8Cap candidate length (essential for incremental).
--min-length=6Skip candidates shorter than 6.
--users=adminCrack only the named user(s).
--groups=0Crack only users in the given group (e.g. root group 0).
--devices=1Select OpenCL device for the *-opencl formats.
Session & output --session=audit1Name the session so you can resume it.
--restore=audit1Resume a named, interrupted session.
--status=audit1Print the status of a running/paused session.
--pot=custom.potUse a specific pot file instead of ~/.john/john.pot.
--show=leftPrint the hashes that are still uncracked.
Core & detection john hash.txtWith no mode flag, John runs single, then wordlist, then incremental automatically.
--format=raw-md5Force a hash format. Needed when auto-detect is ambiguous. See --list=formats.
--list=formatsList every supported format (hundreds in jumbo).
--list=build-infoShow the build and version. Confirm you have jumbo.
--testSelf-test and benchmark the formats.
--show hash.txtPrint cracked passwords as username:password. Add =left for the uncracked ones.
Cracking modes --singleSingle crack: builds candidates from the username/GECOS. Fast, run first.
--wordlist=rockyou.txtWordlist (dictionary) mode.
--wordlist=rockyou.txt --rulesWordlist with word-mangling rules. The highest-yield attack.
--rules=JumboUse a named rules section. Jumbo is the big built-in set.
--incrementalStatistics-driven brute force. Bound with --max-length.
--mask=?u?l?l?l?d?dMask mode: targeted brute force by pattern.
--loopbackUse already-cracked passwords as the wordlist (reuse patterns).
Session & output --session=audit1Name the session so you can resume it.
--restore=audit1Resume a named, interrupted session.
--status=audit1Print the status of a running/paused session.
--pot=custom.potUse a specific pot file instead of ~/.john/john.pot.
--show=leftPrint the hashes that are still uncracked.
Extract hashes from files (*2john) zip2john file.zip > hash.txtEncrypted ZIP (PKZIP and WinZip/AES).
rar2john file.rar > hash.txtRAR3 and RAR5 archives.
7z2john.pl file.7z > hash.txt7-Zip archives.
pdf2john.pl file.pdf > hash.txtPassword-protected PDF.
office2john.py file.docx > hash.txtWord, Excel, PowerPoint (2007 onward).
keepass2john file.kdbx > hash.txtKeePass database master password.
ssh2john id_rsa > hash.txtPassphrase on an encrypted SSH private key.
gpg2john secret.gpg > hash.txtGnuPG symmetric / private key passphrase.
Scope & performance --fork=4Split work across 4 processes (CPU cores).
--max-length=8Cap candidate length (essential for incremental).
--min-length=6Skip candidates shorter than 6.
--users=adminCrack only the named user(s).
--groups=0Crack only users in the given group (e.g. root group 0).
--devices=1Select OpenCL device for the *-opencl formats.
Core & detection john hash.txtWith no mode flag, John runs single, then wordlist, then incremental automatically.
--format=raw-md5Force a hash format. Needed when auto-detect is ambiguous. See --list=formats.
--list=formatsList every supported format (hundreds in jumbo).
--list=build-infoShow the build and version. Confirm you have jumbo.
--testSelf-test and benchmark the formats.
--show hash.txtPrint cracked passwords as username:password. Add =left for the uncracked ones.
Cracking modes --singleSingle crack: builds candidates from the username/GECOS. Fast, run first.
--wordlist=rockyou.txtWordlist (dictionary) mode.
--wordlist=rockyou.txt --rulesWordlist with word-mangling rules. The highest-yield attack.
--rules=JumboUse a named rules section. Jumbo is the big built-in set.
--incrementalStatistics-driven brute force. Bound with --max-length.
--mask=?u?l?l?l?d?dMask mode: targeted brute force by pattern.
--loopbackUse already-cracked passwords as the wordlist (reuse patterns).
Session & output --session=audit1Name the session so you can resume it.
--restore=audit1Resume a named, interrupted session.
--status=audit1Print the status of a running/paused session.
--pot=custom.potUse a specific pot file instead of ~/.john/john.pot.
--show=leftPrint the hashes that are still uncracked.
Extract hashes from files (*2john) zip2john file.zip > hash.txtEncrypted ZIP (PKZIP and WinZip/AES).
rar2john file.rar > hash.txtRAR3 and RAR5 archives.
7z2john.pl file.7z > hash.txt7-Zip archives.
pdf2john.pl file.pdf > hash.txtPassword-protected PDF.
office2john.py file.docx > hash.txtWord, Excel, PowerPoint (2007 onward).
keepass2john file.kdbx > hash.txtKeePass database master password.
ssh2john id_rsa > hash.txtPassphrase on an encrypted SSH private key.
gpg2john secret.gpg > hash.txtGnuPG symmetric / private key passphrase.
Scope & performance --fork=4Split work across 4 processes (CPU cores).
--max-length=8Cap candidate length (essential for incremental).
--min-length=6Skip candidates shorter than 6.
--users=adminCrack only the named user(s).
--groups=0Crack only users in the given group (e.g. root group 0).
--devices=1Select OpenCL device for the *-opencl formats.
The jumbo build ships around a hundred of these. The ones you will actually reach for:
Tool Cracks the password on a... hashcat equivalent mode zip2johnZIP archive (PKZIP / WinZip-AES) 17200 / 13600 rar2johnRAR3 / RAR5 archive 12500 / 13000 7z2john.pl7-Zip archive 11600 pdf2john.plPDF document 10500 / 10600 / 10700 office2john.pyWord / Excel / PowerPoint 9400 / 9500 / 9600 keepass2johnKeePass database 13400 ssh2johnencrypted SSH private key 22911 gpg2johnGnuPG key / message 17010 / 17020
The file-cracking walkthrough is in crack ZIP, RAR, and PDF passwords .
John usually auto-detects, but when it asks, these are the names:
Hash --format=Raw MD5 / SHA-1 / SHA-256 raw-md5 / raw-sha1 / raw-sha256NTLM NTbcrypt bcryptsha512crypt $6$ / sha256crypt $5$ sha512crypt / sha256cryptArgon2 argon2WPA handshake wpapskNetNTLMv2 netntlmv2Kerberos TGS-REP / AS-REP krb5tgs / krb5asrepZIP / RAR5 / PDF / Office / KeePass ZIP / RAR5 / PDF / Office / KeePass
How do I crack a hash with John the Ripper?
Do I need to specify the format in John?
What is the fastest way to use all my CPU cores in John?
Where does John store cracked passwords?
