John the Ripper

What is John the Ripper?

John the Ripper (often shortened to John or JtR) is one of the oldest and most versatile offline password crackers in the world. It is free software, runs from the terminal, and its job is to recover passwords from their hashes: you feed it the hashed form of a password and John tries to discover the plaintext by testing candidates. The version professionals use is John the Ripper jumbo, the community edition, which adds support for hundreds of hash formats (MD5, SHA-256/512, bcrypt, NTLM, ZIP hashes, SSH key hashes, Office document hashes...) and a load of helper utilities.

John stands out for its rule engine and its attack modes: dictionary, mutation rules, brute force and incremental. It is the go-to tool for learning how password attacks work and why weak passwords are a problem.

What John the Ripper is used for

• Auditing password strength: checking whether the credentials on your own systems survive a dictionary attack.
• Authorised pentesting: after obtaining hashes during a permitted assessment, trying to crack them to demonstrate impact.
• Recovering your own files: opening a ZIP, PDF or Office document whose password you have forgotten.
• CTF challenges: almost every CTF includes hash-cracking or protected-file tasks.
• Training: understanding hashes, salting and why bcrypt or Argon2 beat a plain MD5.

Only use it on hashes from your own systems, in labs, in CTFs or with written authorisation. Cracking other people's passwords without permission is illegal.

How to install John the Ripper

On Kali Linux and other security distros the jumbo edition ships preinstalled. On Debian/Ubuntu-based systems:

sudo apt update
sudo apt install john

On macOS with Homebrew:

brew install john-jumbo

If you want the latest community build with every format, compile it from the official openwall/john source:

git clone https://github.com/openwall/john
cd john/src
./configure && make -s

Check it works and list the supported formats:

john --test=0
john --list=formats

How to use John the Ripper: practical examples

Basic dictionary cracking

The most common approach is a dictionary attack with the famous rockyou.txt list (on Kali it lives in /usr/share/wordlists/, sometimes compressed):

john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt

When it finishes (or while it runs), list the passwords already recovered:

john --show hashes.txt

Specifying the hash format

If John does not detect the hash type correctly, set it with --format. For example, for Windows NTLM hashes or raw MD5:

john --format=nt --wordlist=rockyou.txt hashes.txt
john --format=raw-md5 --wordlist=rockyou.txt hashes.txt

Mutation rules and incremental mode

With --rules John applies transformations to each dictionary word (appending numbers, changing case, swapping letters for symbols), multiplying the candidates:

john --wordlist=rockyou.txt --rules hashes.txt

Incremental mode tries combinations intelligently (statistical brute force). Use it when the dictionary fails:

john --incremental hashes.txt

Cracking your lab's /etc/shadow

For Linux user passwords, first combine passwd and shadow with the unshadow utility and then run John:

unshadow /etc/passwd /etc/shadow > myshadow.txt
john --wordlist=rockyou.txt myshadow.txt

The *2john utilities

The real value of the jumbo edition are the converters that extract a crackable hash from a protected file. You generate the hash and hand it to John:

zip2john secret.zip > zip.hash
john --wordlist=rockyou.txt zip.hash

ssh2john id_rsa > ssh.hash
john --wordlist=rockyou.txt ssh.hash

There are many more: rar2john, pdf2john, office2john, keepass2john, and so on. Run ls /usr/share/john/ or search your system for *2john to see them.

Sessions and resuming

john --session=audit --wordlist=rockyou.txt hashes.txt
john --restore=audit

Pro tips

• Identify the hash before attacking. Tools like hashid tell you the format; getting --format right saves a huge amount of time.
• Dictionary + rules beats brute force. Most human passwords fall to a good wordlist and --rules long before --incremental.
• For fast, GPU-friendly hashes (MD5, NTLM), many pentesters pair John with Hashcat, which uses the graphics card. John shines on exotic formats and on files.
• Press any key during cracking to see progress and speed in c/s (candidates per second).
• Build target-specific wordlists (names, dates, company terms) with tools like CeWL; they are often more effective than generic lists.

Pros and cons

Pros	Cons
Free, open source and cross-platform	On slow hashes the CPU trails behind a GPU
Hundreds of formats and *2john utilities	Offline only (you need the hash first)
Powerful, flexible rule engine	Command line with a learning curve

John the Ripper alternatives

• Hashcat: the GPU-accelerated cracker par excellence, ideal for fast hashes and huge lists.
• THC Hydra: for online attacks against login services, not offline hashes.
• Medusa: live brute force of network protocols.
• To practise with real cracking challenges, platforms such as Hack The Box and TryHackMe.

Frequently asked questions

Is John the Ripper free?

Yes. Both the basic version and the community jumbo edition are free and open source, available in the repositories of the main security distros.

What is the difference between John and Hashcat?

Both crack hashes offline. John stands out for its huge variety of formats and the *2john utilities, and works very well on CPU; Hashcat is optimised for GPU and is usually faster on modern, fast hashes.

Where is the rockyou.txt file?

On Kali Linux it is at /usr/share/wordlists/rockyou.txt. Sometimes it ships compressed as rockyou.txt.gz; decompress it with gunzip.

Is it legal to use John the Ripper?

The tool is legal. What is not is cracking passwords of systems or people without authorisation. Use it on your own hashes, in labs or in CTFs.

Want to really understand hashes, salting and password attacks with guided exercises? You will find it at the Hackers en Acción Academy.