Hashcat

3 min readArticle

Hashcat is the world's fastest password cracker. It uses your GPU (graphics card) for massively parallel hash cracking — orders of magnitude faster than CPU-based tools. Supports nearly every hash type imaginable. This is the go-to for offline cracking after you've captured or dumped hashes.

Why GPU Cracking

A modern GPU has thousands of cores vs a CPU's 8-16. For MD5 a good GPU can crack billions of hashes per second, vs millions for CPU. This difference is decisive.

Installation

bash

# Kali — usually pre-installed
hashcat --version

# Ubuntu
sudo apt install hashcat

# Get example hashes for testing
hashcat --example-hashes | grep -A 1 "MODE: 1000"

Hash Types (Common Ones)

Hash Type	Mode	Example
MD5	0	`5f4dcc3b5aa765d61d8327deb882cf99`
SHA1	100	`5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8`
SHA256	1400	—
SHA512	1700	—
NTLM (Windows)	1000	`aad3b435b51404eeaad3b435b51404ee:...`
NetNTLMv2	5600	—
bcrypt	3200	`$2y$10$...`
WPA/WPA2	22000	(from hcxtools .hc22000)
WPA PMKID	22000	same mode
MD5crypt	500	`$1$...`
SHA512crypt	1800	`$6$...`
Kerberoast	13100	—
AS-REP Roast	18200	—

bash

# Identify hash type
hashid 'hash_value_here'
hash-identifier  # interactive

Attack Modes

Mode	Flag	Description
Dictionary	`-a 0`	Wordlist
Combinator	`-a 1`	Combine two wordlists
Brute Force	`-a 3`	Charset mask
Hybrid	`-a 6`	Wordlist + mask
Hybrid	`-a 7`	Mask + wordlist

Dictionary Attack

bash

# Basic wordlist attack
hashcat -m 0 hashes.txt rockyou.txt

# With rules (best64 is a solid starting point)
hashcat -m 0 hashes.txt rockyou.txt -r /usr/share/hashcat/rules/best64.rule

# NTLM hashes
hashcat -m 1000 ntlm_hashes.txt rockyou.txt

# WPA/WPA2
hashcat -m 22000 handshake.hc22000 rockyou.txt

Brute Force (Mask Attack)

Masks:

?l — lowercase (a-z)
?u — uppercase (A-Z)
?d — digits (0-9)
?s — special characters
?a — all printable

bash

# All 8-digit PINs
hashcat -m 0 hash.txt -a 3 ?d?d?d?d?d?d?d?d

# All 8-char lowercase+digit combos
hashcat -m 0 hash.txt -a 3 ?l?l?l?l?l?l?d?d

# Password + 4 digits (hybrid)
hashcat -m 0 hash.txt -a 6 rockyou.txt ?d?d?d?d

# 8-12 char all printable brute force (slow!)
hashcat -m 0 hash.txt -a 3 --increment --increment-min 8 --increment-max 12 ?a?a?a?a?a?a?a?a?a?a?a?a

Rules

Rules apply transformations to each wordlist entry:

bash

# Available rules
ls /usr/share/hashcat/rules/

# Best rules to try in order
hashcat -m 0 hash.txt wordlist.txt -r best64.rule
hashcat -m 0 hash.txt wordlist.txt -r d3ad0ne.rule
hashcat -m 0 hash.txt wordlist.txt -r dive.rule  # Most comprehensive, slower
hashcat -m 0 hash.txt wordlist.txt -r OneRuleToRuleThemAll.rule  # Popular community rule

Useful Flags

bash

-m <type>      # Hash type
-a <mode>      # Attack mode
-o output.txt  # Save cracked hashes
--show         # Show already cracked hashes
--username     # Input has username:hash format
--force        # Ignore warnings (on VMs)
-w 3           # Workload (1=minimal, 4=nightmare)
-O             # Optimized kernel (faster, shorter max password)
--session name # Save session for resuming
--restore      # Resume a session

WPA Workflow (Common Use Case)

bash

# Convert airodump .cap to hashcat format
hcxpcapngtool -o handshake.hc22000 capture-01.cap

# Or from PMKID
hcxdumptool -i wlan0mon -o pmkid.pcapng --enable_status=1
hcxpcapngtool -o pmkid.hc22000 pmkid.pcapng

# Crack it
hashcat -m 22000 handshake.hc22000 rockyou.txt
hashcat -m 22000 handshake.hc22000 rockyou.txt -r best64.rule

# Check results
hashcat -m 22000 handshake.hc22000 --show

Potfile

Hashcat saves cracked hashes in ~/.hashcat/hashcat.potfile. If you re-run a hash that's already cracked, it immediately shows the result. Clear it with:

bash

hashcat --potfile-disable ...  # Don't use potfile for this run

Hashcat

Why GPU Cracking

Installation

Hash Types (Common Ones)

Attack Modes

Dictionary Attack

Brute Force (Mask Attack)

Rules

Useful Flags

WPA Workflow (Common Use Case)

Potfile

See Also