Cyber Research Wiki

Hashcat

A high-performance, cross‑platform password recovery tool that supports hundreds of hash and key‑derivation formats, multiple attack modes, and GPU/accelerator backends for offline credential security testing.

Overview

Hashcat is an open‑source password recovery and auditing utility used to evaluate the strength of stored credentials and related secrets across diverse systems and protocols. It operates on offline cryptographic material—password hashes, password‑derived keys, and certain protocol artifacts—rather than live authentication endpoints. The project supports CPUs and hardware accelerators via CUDA, OpenCL, HIP, and Metal backends, and implements several complementary attack modes (dictionary/straight, combinator, mask/brute‑force, and hybrids). Its hash‑mode catalog spans common and specialized algorithms, including NTLM, bcrypt, PBKDF2, WPA/WPA2 PMKID/EAPOL, and HMAC‑signed JSON Web Tokens (JWT). Hashcat is widely used in security testing, incident response, and digital forensics to validate password policies, identify weak secrets, and benchmark defensive configurations. It is released under the MIT license and actively maintained in a public repository.

What It Is

Hashcat is a command‑line framework for offline password and secret auditing. It focuses on recovering plaintexts from captured hashes, password‑derived encryption keys, and selected protocol artifacts such as WPA/WPA2 handshakes and PMKIDs, as well as attempting to recover secrets used in HMAC‑signed JWTs. It is not an exploitation or online attack framework and does not target live, rate‑limited authentication services. In API‑security contexts, its scope includes evaluation of HMAC‑based JWT secret strength and assessment of password‑derived credentials used by backend systems.

How It Works

Hashcat normalizes inputs to a specific hash‑mode format and selects optimized compute kernels for the chosen algorithm. It then generates candidate passwords/secrets using configurable strategies—dictionary (straight) attacks with rule‑based mutations, combinator attacks that join words, mask/brute‑force patterns, and hybrid methods that mix wordlists and masks. External generators such as maskprocessor, statsprocessor, and princeprocessor can feed additional candidate streams. Workloads execute on CPU or accelerator backends (CUDA, OpenCL, HIP, Metal), enabling large‑scale parallel testing of candidates against target hashes. For Wi‑Fi auditing, WPA/WPA2 handshakes and PMKIDs are converted to the unified 22000/22001 text formats to improve efficiency and reuse of PBKDF2 computations. For JWT auditing, hash‑mode 16500 targets HMAC‑signed tokens by attempting to recover the shared secret; JWTs signed with public‑key algorithms are out of scope for secret recovery. Results are persisted in a potfile, with per‑hash status and performance metrics available for downstream analysis and reporting, including structured status/benchmark outputs.

Core Concepts

Typical Workflow

Use Cases

Limitations

Related Tools

Evidence Gaps

Sources

Confidence

high