How to Use John the Ripper: Practical Password Cracking Guide

In one line

John the Ripper takes scrambled password hashes and figures out the original passwords by trying huge numbers of guesses very fast, all on your own machine.

What this is, for a beginner

John the Ripper is an offline password cracker. It takes password hashes, the scrambled form in which systems store passwords, and tries to recover the original passwords by hashing many guesses and comparing. Because it runs locally against the hashes, it is not slowed by any login defence; its speed depends only on your hardware and the strength of the hashing algorithm.

This makes it the natural partner to any attack that yields hashes, and a great way to understand why password storage matters. Fast hashes fall quickly; slow, salted hashes designed for passwords resist cracking. You will practise entirely on hashes you create yourself, so no real credentials are ever involved.

The legal lab we use: Hashes you generate yourself

This is fully self-contained: create your own hashes and crack them. Never crack hashes obtained from systems you do not own or are not authorized to test.

Hashes you generate yourself project page →

Full walkthrough: exploiting it step by step

Step 1 — Generate your own hashes

Create a small file of password hashes yourself so nothing sensitive is involved. A simple way is to hash a few chosen words in a common format.

terminal

echo -n "password123" | md5sum
# put "user:<hash>" lines into hashes.txt

Expected result: A hashes.txt file containing usernames and hashes you generated, ready to crack.

Step 2 — Run a wordlist attack

Point John at your hash file with a wordlist. It hashes each candidate and compares, reporting any matches it finds.

terminal

john --wordlist=rockyou.txt --format=raw-md5 hashes.txt

Expected result: John cracks the hashes whose plaintext is in the wordlist and prints the recovered passwords.

Step 3 — Show cracked results

Ask John to display everything it has cracked so far, which it also stores so it does not repeat work.

terminal

john --show --format=raw-md5 hashes.txt

Expected result: A list of username and recovered password pairs for the hashes John has solved.

Step 4 — Apply rules to extend the wordlist

Real passwords are variations, so enable mangling rules that transform each word (adding numbers, capitalising, common substitutions), which cracks many passwords a plain list misses.

terminal

john --wordlist=rockyou.txt --rules --format=raw-md5 hashes.txt

Expected result: Additional passwords are cracked because the rules generate realistic variations of the base words.

Step 5 — Compare a slow hash

Generate a hash with a slow, password-appropriate algorithm (such as bcrypt) and try to crack it. It is dramatically slower, demonstrating exactly why systems should store passwords with slow, salted hashing.

Expected result: Cracking the slow hash is far slower per guess, showing why algorithm choice is the main defence against cracking.

Free resource

Get the free 35-week ethical hacking roadmap

The exact order I'd learn this in, every vulnerability and tool, week by week, with the labs to practise each one. Enter your email and I'll send it over, plus one practical lesson each week.

How to detect and fix this

How to detect it

Cracking is offline and silent, so there is nothing to detect on the target; the defence is entirely in how passwords are stored before they are ever stolen.
The relevant signal for defenders is upstream: preventing the breach that would expose the hashes in the first place.
Weak or unsalted hashes in your own systems are a finding regardless of any attack.

How to fix it

Store passwords with a slow, salted, password-specific hashing algorithm such as bcrypt, scrypt, or Argon2, which makes large-scale cracking impractical.
Never use fast general-purpose hashes like MD5 or plain SHA for passwords; they fall almost instantly.
Enforce strong, unique passwords and check against breached lists so even a cracked hash yields little reuse value.
Add multi-factor authentication so a recovered password alone is not enough to log in.

Common beginner mistakes

Specifying the wrong hash format, so John cannot match; identify the format first.
Expecting slow, salted hashes to fall like fast ones; that difference is the whole lesson.
Relying only on a raw wordlist and skipping rules, which crack far more real-world passwords.
Cracking hashes you obtained from systems you do not own or are not authorized to test.

FAQ

What is the difference between John the Ripper and Hydra?

Hydra performs online attacks, guessing against a live login and limited by network speed and defences. John the Ripper performs offline attacks on password hashes you already have, at hardware speed. John needs the hashes first; Hydra needs only a reachable login.

Why do slow hashes matter so much?

Password cracking is a numbers game of guesses per second. Fast hashes like MD5 allow billions of guesses per second and fall quickly, while slow, salted algorithms like bcrypt or Argon2 drastically cut the guess rate, making mass cracking impractical. Algorithm choice is the primary defence.

What do John's rules do?

Rules mangle each wordlist entry into realistic variations, such as adding numbers, capitalising, or substituting characters. Since real passwords are usually variations on common words, rules crack many hashes that a plain wordlist would miss, at the cost of more guesses.

Where to go from here

You just exploited one vulnerability in a lab. Here's the structured path.

Scattered tutorials teach you tricks; they don't make you a pentester. My mentorship is 35 weeks of exactly this, every vulnerability and tool in a deliberate order, on real labs, with one-on-one feedback on your work so your mistakes get caught early instead of becoming habits.

See the mentorship

Keep practising

How to Use Hydra How to Exploit Broken Authentication How to Use SQLmap