John the Ripper
John the Ripper is a flexible offline password cracker used to audit password strength by testing hashes against wordlists and rules.
Legal & ethical use. Crack only hashes that you own or are authorised to audit. Use this tool only on systems, networks and data that you own or have explicit written permission to test. Unauthorised access or scanning can break computer-misuse laws (for example Pakistan's Prevention of Electronic Crimes Act, 2016, and equivalents elsewhere). Practise in your own lab or in authorised environments such as CTFs.
What it is used for
- Audit password hashes from your own test system
- Learn how weak passwords fall to wordlist attacks
Key features
- Many hash formats
- Wordlist, rules and incremental modes
- Helper scripts such as zip2john
Installation
Install from your distribution (`sudo apt install john`) or build the community "jumbo" version from GitHub.
Beginner usage guide
Place hashes from a lab in a file, run a wordlist attack and inspect cracked results with --show.
Example commands
Run these only against your own lab or authorised targets. Placeholder addresses such as 192.0.2.x are documentation ranges.
Crack hashes with a wordlist
john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txtTests each wordlist entry against the hashes; view results later with `john --show hashes.txt`.
References
Source verification
Last reviewed: 2026-10-27
Links checked over HTTP: 2026-10-27 07:51 UTC — official: 200, docs: 200, repo: 200
Command flags checked against the real binary john (Unknown option: "--version") on 2026-10-27.