John the Ripper Cheat Sheet

Versatile offline password cracker with automatic format detection.

Passwords & CrackingcpucrackinghashofflinepasswordsUpdated 2026-06-02

Overview

John the Ripper (Jumbo) cracks password hashes and protected files on CPU (with optional OpenMP/GPU builds). It auto-detects many formats and integrates rules and wordlists. Use only on material you own or are authorized to recover.

Install

sudo apt install john

john --list=formats | head

Essential commands

john hashes.txt

john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt

john --show hashes.txt

john --format=raw-md5 hashes.txt

Quick one-liners

Crack hashes with auto-detected format

john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt

Show cracked passwords

john --show hashes.txt

Crack Linux shadow after unshadow

unshadow passwd shadow > unshadowed.txt && john --wordlist=rockyou.txt unshadowed.txt

Crack NTLM hashes explicitly

john --format=nt --wordlist=rockyou.txt hashes.txt

Resume interrupted cracking session

john --restore

Common workflows

Single hash file (auto-detect) —

unshadow passwd shadow > unshadowed.txt

john unshadowed.txt

john --wordlist=rockyou.txt unshadowed.txt

john --show unshadowed.txt

NTLM / NetNTLM —

john --format=nt hashes.txt

john --format=netntlmv2 netntlm.txt --wordlist=rockyou.txt

Rules and incremental —

john --wordlist=rockyou.txt --rules=best64 hashes.txt

john --incremental=ASCII hashes.txt

ZIP / office / KeePass (Jumbo) —

zip2john protected.zip > zip.hash

john zip.hash

office2john document.docx > office.hash

john office.hash

Pause and restore —

john hashes.txt

Ctrl+C to pause

john --restore

Flags reference

`--wordlist=`	Dictionary file
`--rules=`	Apply rule set
`--format=`	Force hash type
`--show`	Display cracked
`--session=`	Session name
`--restore`	Resume session
`--single`	GECOS/login guessing
`--incremental`	Brute force charset

Tips

Prefer *2john helpers (ssh2john, pdf2john, keepass2john) to produce valid hash lines.
john --list=formats and john --list=format-details help when auto-detect fails.
For large lists, use --fork=4 (if built with OpenMP) on multi-core CPUs.
Pair with hashcat when GPU speed matters; John excels at odd formats and quick wins.