📑 Table of Contents▼
Hashcat
DevelopersJens 'atom' Steube, Gabriele 'matrix' Gristina
Stable release
7.1.2[1] Edit this on Wikidata / 23 August 2025; 9 months ago (23 August 2025)
Operating systemCross-platform
TypePassword cracking
LicenseMIT License
Websitewww.hashcat.net Edit this at Wikidata
Repositorygithub.com/hashcat/hashcat

Hashcat is a password recovery tool. It had a proprietary code base until 2015, but was then released as open source software. Versions are available for Linux, macOS, and Windows. Examples of hashcat-supported hashing algorithms are LM hashes, MD4, MD5, SHA-family and Unix Crypt formats as well as algorithms used in MySQL and Cisco PIX.

Hashcat has received publicity because it is partly based on flaws in other software discovered by its creator. An example was a flaw in 1Password's password manager hashing scheme.[2] It has also been compared to similar software in a Usenix publication[3] and been described on Ars Technica.[4]

Variants

edit

Previously, two variants of hashcat existed:

  • hashcat - CPU-based password recovery tool
  • oclHashcat/cudaHashcat - GPU-accelerated tool (OpenCL or CUDA)

With the release of hashcat v3.00, the GPU and CPU tools were merged into a single tool called hashcat. The CPU-only version became hashcat-legacy.[5] Both CPU and GPU now require OpenCL.

Many of the algorithms supported by hashcat-legacy (such as MD5, SHA1, and others) can be cracked in a shorter time with the GPU-based hashcat.[6] However, not all algorithms can be accelerated by GPUs. Bcrypt is an example of this. Due to factors such as data-dependent branching, serialization, and memory (and more), oclHashcat/cudaHashcat weren't catchall replacements for hashcat-legacy.

hashcat-legacy is available for Linux, OSX and Windows. hashcat is available for macOS, Windows, and Linux with GPU, CPU and generic OpenCL support which allows for FPGAs and other accelerator cards.

Sample output

edit 
hashcat (v7.0.0) starting

CUDA API (CUDA 12.9)
====================
* Device #01: NVIDIA GeForce RTX 4090, 23687/24080 MB, 128MCU
* Device #02: NVIDIA GeForce RTX 4090, 23687/24080 MB, 128MCU

OpenCL API (OpenCL 3.0 CUDA 12.9.76) - Platform #2 [NVIDIA Corporation]
=======================================================================
* Device #04: NVIDIA GeForce RTX 4090, skipped
* Device #05: NVIDIA GeForce RTX 4090, skipped

Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256
Minimum salt length supported by kernel: 0
Maximum salt length supported by kernel: 256

Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates

Optimizers applied:
* Zero-Byte
* Single-Hash
* Single-Salt
* Brute-Force
* Slow-Hash-DimensionY-LOOP

Watchdog: Temperature abort trigger set to 90c

Host memory allocated for this attack: 512 MB (164979 MB free)

$argon2id$v=19$m=65536,t=3,p=1$FBMjI4RJBhIykCgol1KEJA$2ky5GAdhT1kH4kIgPN/oERE3Taiy43vNN70a3HpiKQU:hashcat

Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 34000 (Argon2)
Hash.Target......: $argon2id$v=19$m=65536,t=3,p=1$FBMjI4RJBhIykCgol1KE...HpiKQU
Time.Started.....: Fri Aug  1 14:07:43 2025 (14 secs)
Time.Estimated...: Fri Aug  1 14:07:57 2025 (0 secs)
Kernel.Feature...: Pure Kernel (password length 0-256 bytes)
Guess.Mask.......: ?l?l?l?lcat [7]
Guess.Queue......: 1/1 (100.00%)
Speed.#01........:     1699 H/s (17.23ms) @ Accel:354 Loops:1 Thr:32 Vec:1
Speed.#02........:     1696 H/s (17.21ms) @ Accel:354 Loops:1 Thr:32 Vec:1
Speed.#*.........:     3395 H/s
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 45666/456976 (9.99%)
Rejected.........: 0/45666 (0.00%)
Restore.Point....: 1062/17576 (6.04%)
Restore.Sub.#01..: Salt:0 Amplifier:12-13 Iteration:11-12
Restore.Sub.#02..: Salt:0 Amplifier:12-13 Iteration:10-11
Candidate.Engine.: Device Generator
Candidates.#01...: htrecat -> hoelcat
Candidates.#02...: hepacat -> hbencat
Hardware.Mon.#01.: Temp: 53c Fan: 30% Util: 99% Core:2790MHz Mem:10251MHz Bus:16
Hardware.Mon.#02.: Temp: 51c Fan: 30% Util: 99% Core:2715MHz Mem:10251MHz Bus:8

Started: Fri Aug  1 14:07:35 2025
Stopped: Fri Aug  1 14:07:58 2025

Attack types

edit

Hashcat offers multiple attack modes for obtaining effective and complex coverage over a hash's keyspace. These modes are:

The traditional bruteforce attack is considered outdated, and the Hashcat core team recommends the Mask-Attack as a full replacement.

Competitions

edit

Team Hashcat[9] (the official team of the Hashcat software composed of core Hashcat members) won first place in the KoreLogic "Crack Me If you Can" Competitions at DefCon in 2010,[10] 2012, 2014,[11] 2015,[12] and 2018, and at DerbyCon in 2017.

See also

edit

References

edit
  1. ^ "Release 7.1.2". 23 August 2025. Retrieved 15 September 2025.
  2. ^ "On hashcat and strong Master Passwords as your best protection". Passwords. Agile Bits. 16 April 2013.
  3. ^ Ur, Blase (12 August 2015). "Measuring Real-World Accuracies and Biases in Modeling Password Guessability" (PDF). Proceedings of the 24th USENIX Security Symposium.
  4. ^ Goodin, Dan (26 August 2013). ""thereisnofatebutwhatwemake" - Turbo-charged cracking comes to long passwords". Ars Technica. Retrieved 21 July 2020.
  5. ^ "hashcat v3.00". Hashcat. Hashcat project. 29 June 2016.
  6. ^ "Recent Developments in Password Cracking". Passwords. Bruce Schneier. 19 September 2012.
  7. ^ a b c d e f g "Hashcat [hashcat wiki]".
  8. ^ "PRINCE: modern password guessing algorithm" (PDF). Hashcat site. Hashcat. 8 December 2014.
  9. ^ Team Hashcat
  10. ^ ""Crack Me If You Can" - DEFCON 2010". contest-2010.korelogic.com. Retrieved 21 July 2020.
  11. ^ "Crack Me If You Can 2014 Contest". KoreLogic Security.
  12. ^ "Another trophy in the Pocket! Win @ CMIYC contest 2015". hashcat.net. Retrieved 21 July 2020.
edit

📚 Artikel Terkait di Wikipedia

NTLM

ntlmv1-multitool to format NTLMv1 challenge responses in a hashcat compatible cracking format. With hashcat and sufficient GPU power the NTLM hash can be derived

Security Account Manager

2.5hrs". www.theregister.co.uk. Retrieved 2020-11-26. hashcat (2019-02-13). "hand-tuned hashcat 6.0.0 beta and 2080Ti (stock clocks) breaks NTLM cracking

Password cracking

passwords commonly used in enterprise settings[citation needed]. Using ocl-Hashcat Plus on a Virtual OpenCL cluster platform, the Linux-based GPU cluster

MacPorts

PortSystem 1.0 PortGroup github 1.0 PortGroup makefile 1.0 github.setup hashcat hashcat 6.2.3 v github.tarball_from archive categories security license MIT

IEEE 802.11r-2008

identifier CVE-2017-13082. On August 4, 2018, researcher Jens Steube (of Hashcat) described a new technique to crack WPA2 and WPA PSK (pre-shared key) passwords

Brute-force attack

GPUs were linked together to test password strength by using the software Hashcat with results that showed 200 billion eight-character NTLM password combinations

Dictionary attack

values is large enough. Cain and Abel Crack Aircrack-ng John the Ripper Hashcat L0phtCrack Metasploit Project Ophcrack Cryptool Brute-force attack E-mail

Gravatar

forum by using Gravatar URLs and the open-source Hashcat password cracking tool. Given that Hashcat uses graphics processing units to achieve high efficiencies