Hashcat
Hashcat is a very fast password-recovery tool that uses GPUs and CPUs to test candidates against many hash types.
Legal & ethical use. Use only on hashes you are authorised to test. Use this tool only on systems, networks and data that you own or have explicit written permission to test. Unauthorised access or scanning can break computer-misuse laws (for example Pakistan's Prevention of Electronic Crimes Act, 2016, and equivalents elsewhere). Practise in your own lab or in authorised environments such as CTFs.
What it is used for
- Measure the strength of password hashes in an authorised audit
- Practise hash identification and cracking in CTFs
Key features
- Hundreds of hash modes
- GPU acceleration
- Mask, rule and combinator attacks
Installation
Download the binaries from hashcat.net or install from your distribution; GPU drivers/OpenCL are required for best speed.
Beginner usage guide
Identify the hash type, choose the right mode number (-m), start with a wordlist then add rules.
Example commands
Run these only against your own lab or authorised targets. Placeholder addresses such as 192.0.2.x are documentation ranges.
Dictionary attack on MD5 hashes
hashcat -m 0 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt-m 0 selects MD5 and -a 0 a straight dictionary attack.
References
Source verification
Last reviewed: 2026-10-27
Links checked over HTTP: 2026-10-27 07:51 UTC — official: 200, docs: 200, repo: 200
Command flags checked against the real binary hashcat (v7.1.2) on 2026-10-27.