What Is John the Ripper?
John the Ripper is an open-source password security auditing tool used to evaluate the strength of password hashes in authorized environments.
It supports multiple password-hash formats and provides several auditing techniques, including wordlist-based testing, single mode, incremental mode, and rule-based candidate generation.
The basic workflow is: identify the hash → select an appropriate format → test authorized password hashes → review results → report weaknesses.
John the Ripper Tutorial for Beginners
John the Ripper is one of the best-known tools for password security auditing. Security professionals use it to determine whether passwords represented by authorized hashes are sufficiently resistant to common password-guessing techniques.
The tool is especially useful in penetration-testing laboratories, security assessments, Linux administration training, and password security reviews.
Why Password Auditing Matters
A password can be technically valid while still being weak from a security perspective. Common passwords, predictable patterns, reused credentials, and short passwords can make authentication systems easier to compromise.
Password auditing helps organizations identify these weaknesses before they are exploited.
How to Install John the Ripper
Kali Linux
John the Ripper is commonly available in Kali Linux repositories. First verify whether it is already installed.
john --version
If the package is not available on your installation, update the package database and install the package available for your release.
sudo apt update sudo apt install john
Ubuntu and Debian
sudo apt update sudo apt install john
Fedora
sudo dnf install john
macOS
brew install john-jumbo
Verify the Installation
john --version john --test
John the Ripper Basic Commands
Before performing an audit, learn the command-line options available in your installed version.
john --help
john --version
john --list=formats
john --test
John the Ripper Command Syntax
The general structure of a John command is:
john [options] [hash-file]
| Option | Purpose | Example |
|---|---|---|
--help |
Display command-line help | john --help |
--version |
Display version information | john --version |
--list=formats |
List supported hash formats | john --list=formats |
--wordlist |
Use a wordlist | john --wordlist=list.txt hashes.txt |
--single |
Use single mode | john --single hashes.txt |
--incremental |
Use incremental mode | john --incremental hashes.txt |
--rules |
Apply word mangling rules | john --wordlist=list.txt --rules hashes.txt |
--format |
Select a hash format | john --format=nt hashes.txt |
--show |
Display recovered results | john --show hashes.txt |
--status |
Display current status | john --status |
--session |
Create a named session | john --session=audit1 hashes.txt |
--restore |
Restore a session | john --restore=audit1 |
John the Ripper Wordlist Mode
Wordlist mode tests password candidates from a supplied list. It is often the first practical method used during an authorized password audit because common passwords can be tested efficiently.
john --wordlist=wordlist.txt hashes.txt
Using a Local Wordlist
john --wordlist=/path/to/wordlist.txt hashes.txt
Using Rules With a Wordlist
john --wordlist=wordlist.txt --rules hashes.txt
John the Ripper Single Mode
Single mode uses information associated with usernames and account fields to generate password candidates. It can be useful when an authorized test contains user information that may influence password choices.
john --single hashes.txt
Single mode is useful as an early testing technique because it can quickly identify predictable password choices.
John the Ripper Incremental Mode
Incremental mode generates password candidates according to the configured character sets and statistical models.
john --incremental hashes.txt
John the Ripper Rules
Rules transform words from a wordlist into additional password candidates. For example, a base word can be transformed into different capitalization or suffix variations.
john --wordlist=wordlist.txt --rules hashes.txt
View Generated Candidates
john --wordlist=wordlist.txt --rules --stdout
Rules are particularly useful when users create passwords by modifying common words with predictable patterns.
John the Ripper Hash Formats
Hash format selection is important because John needs to know how the stored password representation should be processed.
| Hash Type | Example Format | John Option |
|---|---|---|
| Raw MD5 | 32 hexadecimal characters | --format=raw-md5 |
| Raw SHA-1 | 40 hexadecimal characters | --format=raw-sha1 |
| Raw SHA-256 | 64 hexadecimal characters | --format=raw-sha256 |
| NTLM | Windows NT hash | --format=nt |
| bcrypt | bcrypt password hash | --format=bcrypt |
| SHA-512 crypt | Unix crypt format | --format=sha512crypt |
List All Available Formats
john --list=formats
john --list=formats on the system being used.
Specify a Hash Format
When John does not automatically select the desired format, you can specify it explicitly.
john --format=raw-md5 --wordlist=wordlist.txt hashes.txt
For another supported format:
john --format=nt --wordlist=wordlist.txt hashes.txt
How to Show Recovered Passwords
After an authorized audit has completed, the --show
option can be used to display results recorded by John.
john --show hashes.txt
Avoid publishing recovered credentials or sensitive password data. Security reports should minimize exposure of confidential information.
John the Ripper Session Management
Long-running password audits can be saved as named sessions so that they can be resumed later.
Create a Session
john --session=audit1 hashes.txt
Restore a Session
john --restore=audit1
Check Status
john --status
John the Ripper Benchmark
Benchmarking helps security professionals understand the approximate performance of their testing environment.
john --test
Benchmark results depend on the CPU, operating system, build, configuration, and enabled optimizations.
Understanding John the Ripper Output
During an audit John displays information about the number of hashes, processing speed, progress, and other runtime details.
Loaded password hashes Press 'q' or Ctrl-C to abort Use the "--show" option to display cracked passwords
Loaded Hashes
Indicates how many password hashes John has successfully loaded.
Progress
Shows information about the current testing process and candidate generation.
Speed
Indicates how quickly the current configuration is processing candidates.
Common John the Ripper Errors
| Error | Possible Cause | Recommended Action |
|---|---|---|
| No password hashes loaded | Unsupported or malformed input | Verify the file and selected format. |
| Unknown ciphertext format | John cannot identify the format | Check available formats and specify the correct one. |
| File not found | Incorrect path | Verify the filename and directory. |
| Permission denied | Insufficient file permissions | Check ownership and permissions. |
| Session already exists | A previous session uses the same name | Restore the existing session or select another session name. |
Professional John the Ripper Password Auditing Workflow
1. Authorization
Confirm written permission and define the scope of the security assessment.
2. Preparation
Prepare authorized test hashes and establish a controlled lab or assessment environment.
3. Identification
Determine the appropriate hash format and verify that the input is valid.
4. Initial Audit
Begin with appropriate wordlist or single-mode testing.
5. Advanced Testing
Where permitted, use rules or additional controlled techniques.
6. Reporting
Document weak-password findings without exposing unnecessary credentials.
7. Remediation
Improve password policies, authentication controls, and credential security.
8. Retesting
Verify that identified weaknesses have been addressed.
John the Ripper vs Hashcat
| Feature | John the Ripper | Hashcat |
|---|---|---|
| Primary Focus | General password auditing | High-performance password recovery |
| CPU Support | Strong | Strong |
| GPU Focus | Available in some builds | Major strength |
| Learning Curve | Beginner friendly | More extensive options |
| Best Use | General auditing and Unix-oriented workflows | Large-scale high-performance workloads |
John the Ripper vs Hydra
| Feature | John the Ripper | Hydra |
|---|---|---|
| Testing Type | Offline password auditing | Online authentication testing |
| Input | Password hashes | Authentication services |
| Network Traffic | Generally no target authentication traffic | Generates authentication requests |
| Main Purpose | Password strength assessment | Authentication-service testing |
How to Defend Against Password Attacks
Use Strong Passwords
Use long, unique passwords and avoid common or predictable patterns.
Enable MFA
Multi-factor authentication adds an additional security layer beyond passwords.
Use Modern Password Hashing
Applications should use appropriate password-hashing algorithms such as Argon2id, bcrypt, or PBKDF2 with suitable parameters.
Prevent Password Reuse
Users should not reuse passwords across multiple services.
Monitor Authentication
Monitor suspicious login activity, credential attacks, and unusual authentication patterns.
Use Password Managers
Password managers can generate and store unique credentials for users.
John the Ripper Commands Cheat Sheet
| Purpose | Command |
|---|---|
| Help | john --help |
| Version | john --version |
| List formats | john --list=formats |
| Benchmark | john --test |
| Wordlist audit | john --wordlist=wordlist.txt hashes.txt |
| Rules | john --wordlist=wordlist.txt --rules hashes.txt |
| Single mode | john --single hashes.txt |
| Incremental mode | john --incremental hashes.txt |
| Select format | john --format=FORMAT hashes.txt |
| Show results | john --show hashes.txt |
| Create session | john --session=audit1 hashes.txt |
| Restore session | john --restore=audit1 |
| Status | john --status |
Frequently Asked Questions About John the Ripper
What is John the Ripper?
John the Ripper is an open-source password security auditing tool used to evaluate the strength of password hashes in authorized environments.
What is John the Ripper used for?
It is primarily used for password auditing, security assessments, training labs, and testing the resilience of password hashes.
Is John the Ripper legal?
The software itself is legitimate security software. Its use must comply with applicable laws, policies, and authorization requirements.
Is John the Ripper available on Kali Linux?
John the Ripper is available through Kali Linux packages. Check your
current Kali installation with john --version.
How do I check the John version?
Run john --version from the terminal.
How do I see John’s supported formats?
Run john --list=formats.
How do I use a wordlist with John?
Use the --wordlist option with an authorized test-hash
file.
What is John single mode?
Single mode generates password candidates using information associated with user accounts.
What is John incremental mode?
Incremental mode generates password candidates according to configured character sets and statistical models.
How do I use John rules?
Use --rules with a wordlist to generate additional
candidate variations.
How do I display John results?
Use john --show hashes.txt after an authorized audit.
How do I save a John session?
Use the --session option to assign a name to the session.
How do I restore a John session?
Use john --restore=session-name.
Can John the Ripper audit NTLM hashes?
Yes. Supported formats depend on the installed version. Use
john --list=formats to verify available formats.
Can John the Ripper audit bcrypt?
Yes. Modern John builds support bcrypt. The exact format name should be verified using the installed version.
Is John the Ripper free?
The Openwall John the Ripper project provides open-source versions of the software.
Is John the Ripper better than Hashcat?
Neither tool is universally better. The best choice depends on the hash type, hardware, workflow, and assessment requirements.
Is John the Ripper better than Hydra?
They are designed for different purposes. John focuses on offline password-hash auditing, while Hydra is designed for authorized online authentication testing.
What is the best John the Ripper command for beginners?
Start by learning john --help,
john --list=formats, and the wordlist workflow in an
authorized lab.
Can John the Ripper be used for cybersecurity training?
Yes. It is useful for controlled password-security labs and ethical hacking education.
John the Ripper: Quick Expert Summary
John the Ripper is an offline password auditing tool. It helps cybersecurity professionals evaluate password-hash strength in authorized environments.
The most important concepts to learn are: hash formats, wordlists, rules, single mode, incremental mode, sessions, output analysis, and defensive password security.
A professional workflow should always include authorization, controlled testing, evidence collection, remediation, and retesting.
Official & Authoritative Resources
John the Ripper
Official project information, downloads, and documentation.
OWASP
OWASP Password Security Resources
Password security guidance for application security professionals.
