- C 92.7%
- Python 3.3%
- Common Lisp 2.8%
- Shell 0.3%
- Objective-C 0.2%
- Other 0.7%
| .github | ||
| bridges/subs | ||
| charsets | ||
| deps | ||
| docker | ||
| docs | ||
| extra/tab_completion | ||
| feeds | ||
| include | ||
| masks | ||
| modules | ||
| obj | ||
| OpenCL | ||
| pcfg | ||
| Python | ||
| rules | ||
| Rust | ||
| src | ||
| tables | ||
| tools | ||
| tunings | ||
| .appveyor.yml.old | ||
| .editorconfig | ||
| .gitattributes | ||
| .gitignore | ||
| AGENTS.md | ||
| BUILD.md | ||
| BUILD_Android.md | ||
| BUILD_CYGWIN.md | ||
| BUILD_Docker.md | ||
| BUILD_macOS.md | ||
| BUILD_MSYS2.md | ||
| BUILD_WSL.md | ||
| CONTRIBUTING.md | ||
| example.dict | ||
| example0.cmd | ||
| example0.hash | ||
| example0.sh | ||
| example400.cmd | ||
| example400.hash | ||
| example400.sh | ||
| example500.cmd | ||
| example500.hash | ||
| example500.sh | ||
| hashcat.hcstat2 | ||
| Makefile | ||
| README.md | ||
| RUNTIME_Docker.md | ||
| SECURITY.md | ||
hashcat
hashcat is a highly optimized password recovery platform for GPUs, CPUs, and large distributed systems.
Features
- World's fastest password cracker
- World's first and only in-kernel rule engine
- Free and open source, under the MIT license
- Multi-OS: Linux, Windows and macOS
- Multi-backend: CUDA, HIP, Metal and OpenCL
- Multi-device: several devices, and mixed device types, in one system
- Multi-hash: cracks large numbers of hashes at once
- Over 590 hash modes, each written with performance in mind
- 10 attack modes: wordlist, combination, brute-force, PCFG, table, two hybrids, a mask that says where the word goes, generic plugin feeds and association
- Assimilation bridge: add a hash mode in C, Python or Rust, without writing a kernel
- Brain: skips candidates an earlier session already tried
- Distributed cracking networks, using an overlay
- Reads candidates from a wordlist, from stdin, or from another program
- Markov chain keyspace ordering, so the likely candidates come first
- Automatic performance tuning per device
- Interactive pause and resume
- Named sessions, and restore after an interruption
- Built-in benchmark
- Integrated thermal watchdog
- Hex salt and hex charset, for hashes and character sets that are not text
- Encrypted plains: crack a hash for someone else without being able to read the password
- Keyboard layout mapping, for full disk encryption passwords typed on a non-US keyboard
License
hashcat is licensed under the MIT license. See docs/license.txt.
Installation
Download the latest release and unpack it where you want it. Use 7z x when unpacking from the command line, so the full file paths stay intact.
Your platform may also provide packages.
Building
Building from source is optional. The release package is the same program, and a binary you build yourself will not crack any faster. Build it if you want a change of your own, a fix that is in master but not yet released, or a platform we do not ship a binary for.
See BUILD.md for how.
Tests:
| Build | BSD | Rust |
|---|---|---|
 |
 |
 |
Usage and help
Start with --help, also kept in the tree as docs/hashcat-help.md. One example hash per mode is in docs/hashcat-example-hashes.md.
The wiki and the FAQ go further. The forum holds years of answered questions. If you still need help from a real human, come to Discord.
Documentation
The docs directory covers each feature. The ones people ask about most:
- Plugin development guide, for adding a hash mode
- Assimilation bridge, and its Python and Rust quickstarts
- Generic attack mode and PCFG
- Brain, slow candidates, encrypted plains
- Keyboard layout mapping
- Compression libraries, for reading gzip, xz and zstd files
- Release notes for v7.1.0, and the full changelog
Contributing
Contributions are welcome. CONTRIBUTING.md has the code style, what a pull request needs, and how to test a change before you send it.
Security
SECURITY.md has how to report a vulnerability, and what counts as one.