John the Ripper: 10 Essential Password Cracking Commands

Bybwright
John the Ripper

John the Ripper is one of the most widely used password auditing and hash-cracking tools in cybersecurity. It is commonly encountered during penetration testing, Windows and Linux credential analysis, CTF challenges, and TryHackMe rooms.

For cybersecurity students, learning John the Ripper is about more than running a password cracking command. The more important skill is understanding the complete credential-auditing workflow: locating password hashes, extracting them into a usable format, identifying the hash type, selecting an appropriate attack, and analyzing the results.

Windows provides an excellent example.

Local Windows password hashes are stored in the SAM database, but simply obtaining a copy of the SAM hive is not the end of the process. Tools from the Impacket suite can process Windows registry hives and extract local account hashes. Those hashes can then be supplied to John the Ripper for an authorized password-strength audit.

In this guide, we’ll look at that complete workflow along with wordlists, Linux password hashes, password-protected archives, SSH private keys, cracking sessions, and some of the most useful John commands.

Important: Only extract or crack credentials from systems, accounts, files, and hashes you own or have explicit authorization to test. The examples below are intended for personal labs, CTF environments, TryHackMe rooms, and authorized security assessments.

What Is John the Ripper?

John the Ripper is a command-line password auditing and recovery tool.

It is commonly invoked using:

john

John does not normally “decrypt” a password hash.

Instead, it generates password candidates and processes those candidates using the appropriate hashing algorithm. The resulting values are compared against the target hash.

Conceptually:

Password Candidate
        |
        v
 Hashing Algorithm
        |
        v
 Generated Hash
        |
        v
Compare With Target Hash
        |
        v
      Match?

If the generated value matches the target hash, John has discovered a password candidate that corresponds to that hash.

This distinction is important when learning how password cracking actually works.

Why John the Ripper Matters in Cybersecurity

Password hashes frequently become important during security assessments because applications and operating systems generally should not store user passwords directly as plaintext.

Instead, password-verification information is stored using cryptographic techniques.

If an attacker obtains those hashes, they may be able to perform an offline password attack.

That matters because an offline attack occurs outside the normal authentication process. Controls such as account lockouts may therefore provide no protection against the cracking attempt itself.

John the Ripper helps security professionals evaluate this risk.

Common uses include:

  • Password security audits
  • Windows credential analysis
  • Linux password auditing
  • CTF challenges
  • TryHackMe rooms
  • Password-protected file recovery
  • Testing password policies
  • Demonstrating weak password choices
  • Authorized penetration testing

1. Extract Windows SAM and SYSTEM Registry Hives

Before John can audit a Windows NT password hash, the hash first needs to come from somewhere.

On Windows, local account password information is stored in the Security Account Manager (SAM) database.

The relevant registry hive is:

HKLM\SAM

However, the SAM hive alone is not sufficient for extracting usable local password hashes.

Information from the Windows SYSTEM hive is also required during the extraction process.

In an authorized Windows lab, open an elevated Command Prompt and save copies of the hives:

reg save HKLM\SAM SAM

Then:

reg save HKLM\SYSTEM SYSTEM

Command Breakdown

ComponentPurpose
regWindows Registry command-line utility
saveSaves a registry hive to a file
HKLM\SAMLocal Security Account Manager hive
HKLM\SYSTEMWindows SYSTEM registry hive
SAMOutput file for the SAM hive
SYSTEMOutput file for the SYSTEM hive

You should now have two files:

SAM
SYSTEM

These files can be analyzed offline.

Security Note: Access to SAM and SYSTEM registry hive data should be tightly controlled. Copies of these files may allow local password hashes to be recovered without interacting with the normal Windows login process.

2. Extract Windows Password Hashes with Impacket

Once the SAM and SYSTEM files have been transferred to your authorized analysis machine, Impacket can process them.

Impacket is a collection of Python classes and utilities designed for interacting with network protocols, particularly those found in Windows and Active Directory environments.

One of its utilities is secretsdump.

Using the exported hives:

impacket-secretsdump -sam SAM -system SYSTEM LOCAL

Depending on how Impacket is packaged on your system, you may encounter the utility under a different command name, such as:

secretsdump.py -sam SAM -system SYSTEM LOCAL

What the Command Does

ComponentPurpose
impacket-secretsdumpRuns the Impacket secretsdump utility
-sam SAMSpecifies the exported SAM hive
-system SYSTEMSpecifies the exported SYSTEM hive
LOCALTells secretsdump to process local hive files

The basic workflow is:

Windows System
      |
      v
  SAM + SYSTEM
      |
      v
Impacket secretsdump
      |
      v
 Local Account Hashes

This is an important distinction:

John the Ripper is performing the password audit, while Impacket is helping obtain the hash material that John can test.

That makes Impacket a natural companion tool to John.

3. Understand the Extracted Windows Hash

A local Windows account entry extracted during an authorized lab may contain multiple colon-separated fields.

A commonly encountered structure resembles:

username:RID:LM-HASH:NT-HASH:::

For modern Windows password auditing, the NT hash is generally the value of interest.

The NT hash can be copied into a separate file for testing.

For example:

hashes.txt

Important: Do not assume every hexadecimal-looking string is an NT hash. Understand the source and structure of the credential material before selecting a cracking format.

This gives us the complete transition from Windows credential storage into John the Ripper.

SAM + SYSTEM
      |
      v
  secretsdump
      |
      v
    NT Hash
      |
      v
 hashes.txt
      |
      v
John the Ripper

4. Crack a Windows NT Hash with John

Once the authorized NT hash has been placed into a file, John can perform a password audit against it.

For example:

john --format=NT --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt

Command Breakdown

ComponentPurpose
johnStarts John the Ripper
--format=NTSpecifies the Windows NT hash format
--wordlist=Specifies a password wordlist
rockyou.txtWordlist containing password candidates
hashes.txtFile containing the hash being audited

John reads each candidate from the wordlist and tests it against the target hash.

If a candidate produces the correct value, John records the result.

This workflow demonstrates why weak Windows passwords remain dangerous even if an attacker never learns the plaintext password directly from the target computer.

5. Display a Password John Already Recovered

John stores successfully recovered passwords so they do not need to be cracked repeatedly.

To display results for the Windows NT hash:

john --show --format=NT hashes.txt

For other hash files where the format does not need to be explicitly supplied:

john --show hashes.txt

This is one of the most useful John commands to remember.

A common beginner mistake is rerunning the entire cracking operation when John has already stored the result.

Try --show first.

6. Use a Custom Wordlist

John is not limited to RockYou.

The general syntax for a wordlist attack is:

john --wordlist=wordlist.txt hashes.txt

A wordlist is simply a collection of password candidates.

For example:

password
welcome
football
dragon
summer2026

John tests each candidate against the supplied hash.

Dictionary attacks can be extremely effective because real users frequently select predictable passwords based on words, seasons, dates, company names, sports teams, keyboard patterns, and other memorable information.

This is one reason organizations should encourage long, unique passwords rather than relying solely on arbitrary complexity requirements.

7. Identify and Specify Hash Formats

Automatic hash detection is convenient, but it should not be blindly trusted.

When the hash type is known, specify it explicitly.

The general syntax is:

john --format=<FORMAT> hashes.txt

For our Windows example:

john --format=NT hashes.txt

To view formats supported by many John Jumbo installations:

john --list=formats

Available formats vary depending on the John version and build installed on the system.

Understanding where a hash originated is often more reliable than attempting to identify it based solely on appearance.

8. Audit Linux Password Hashes with unshadow

John is also frequently used when auditing Linux credentials.

Linux traditionally separates user account information and password hashes between:

/etc/passwd

and:

/etc/shadow

The /etc/passwd file contains account information, while /etc/shadow contains password hashes and password-aging information.

In an authorized lab where copies of both files are available, John’s unshadow utility can combine them:

unshadow passwd.txt shadow.txt > combined.txt

The resulting file can then be supplied to John:

john --wordlist=wordlist.txt combined.txt

Results can be displayed using:

john --show combined.txt

Access to /etc/shadow normally requires elevated privileges because password hashes are sensitive credential material.

9. Audit a Password-Protected ZIP File

John can also work with password-protected files, but there is an important concept to understand.

You do not necessarily point John directly at the original file.

Instead, helper utilities convert the protected file’s password-verification information into something John understands.

For ZIP archives, the helper is commonly:

zip2john

Extract the relevant information:

zip2john protected.zip > ziphash.txt

Then run John:

john --wordlist=wordlist.txt ziphash.txt

Display the recovered result:

john --show ziphash.txt

The workflow becomes:

Protected ZIP
      |
      v
   zip2john
      |
      v
 John-Compatible Data
      |
      v
     John

10. Audit a Password-Protected SSH Private Key

Password-protected SSH private keys can use a similar workflow.

A commonly encountered helper is:

ssh2john

For example:

ssh2john id_rsa > sshhash.txt

Depending on your installation, the helper may instead appear as:

ssh2john.py

Once the data has been extracted:

john --wordlist=wordlist.txt sshhash.txt

Then check the results:

john --show sshhash.txt

This reinforces an important John concept:

Protected Object
       |
       v
Extraction / Conversion
       |
       v
John-Compatible Input
       |
       v
Password Audit

The extraction utility changes depending on what is being analyzed.

Understanding the *2john Utilities

John the Ripper includes or is commonly distributed alongside helper utilities for converting various protected formats into data John can process.

Examples include:

zip2john
ssh2john

The exact utilities available depend on the John installation.

Rather than memorizing every helper, remember the methodology:

Identify protected file
        |
        v
Find appropriate *2john helper
        |
        v
Extract password-verification data
        |
        v
Select wordlist or attack strategy
        |
        v
Run John
        |
        v
Review results

Once you understand this pattern, many John exercises become much easier to approach.

Create and Restore John Sessions

Password cracking can take time.

John supports named sessions so a longer audit can be interrupted and continued later.

Create a session:

john --session=audit --wordlist=wordlist.txt hashes.txt

Check status:

john --status

Restore the saved session:

john --restore=audit

This is particularly useful when testing larger wordlists or more computationally expensive password formats.

John the Ripper Incremental Mode

John also supports incremental candidate generation.

john --incremental hashes.txt

Unlike a straightforward wordlist attack, incremental mode generates password candidates according to John’s configured character sets and cracking behavior.

This can dramatically increase the amount of work required.

A targeted wordlist is therefore often a sensible first step during an authorized password audit.

John the Ripper vs. Impacket

John and Impacket serve different purposes, even though they can appear together during the same assessment.

ToolPrimary Role
John the RipperPassword auditing and recovery
ImpacketPython toolkit for network protocols and Windows/AD interaction
secretsdumpImpacket utility capable of extracting credential information
unshadowPrepares Linux passwd/shadow information for John
zip2johnPrepares ZIP password data for John
ssh2johnPrepares protected SSH key data for John

For our Windows example:

reg save
   |
   v
SAM + SYSTEM
   |
   v
Impacket secretsdump
   |
   v
NT Hash
   |
   v
John the Ripper

This illustrates an important lesson in cybersecurity: tools are rarely used completely in isolation.

One tool obtains or prepares information, while another analyzes it.

John the Ripper vs. Hashcat

John the Ripper and Hashcat are both popular password-auditing tools.

FeatureJohn the RipperHashcat
Command-line interfaceYesYes
Wordlist attacksYesYes
Rule-based attacksYesYes
CPU crackingYesYes
GPU-focused crackingBuild dependentMajor strength
*2john ecosystemExcellentDifferent workflow
CTF usageExcellentExcellent
Password auditingExcellentExcellent

John is particularly convenient when working with formats supported by its extensive collection of conversion utilities.

Hashcat is especially well known for high-performance GPU password recovery.

Both are valuable tools to understand.

Useful John the Ripper Cheat Sheet

TaskCommand
Save Windows SAMreg save HKLM\SAM SAM
Save Windows SYSTEMreg save HKLM\SYSTEM SYSTEM
Extract local Windows hashesimpacket-secretsdump -sam SAM -system SYSTEM LOCAL
NT wordlist auditjohn --format=NT --wordlist=wordlist.txt hashes.txt
Show NT resultsjohn --show --format=NT hashes.txt
Basic wordlist attackjohn --wordlist=wordlist.txt hashes.txt
List supported formatsjohn --list=formats
Combine Linux credential filesunshadow passwd.txt shadow.txt > combined.txt
Extract ZIP datazip2john protected.zip > ziphash.txt
Extract SSH key datassh2john id_rsa > sshhash.txt
Create sessionjohn --session=audit hashes.txt
Restore sessionjohn --restore=audit
Check statusjohn --status
Incremental modejohn --incremental hashes.txt

Common John the Ripper Mistakes

Starting with John Before Understanding the Hash

Before attempting to crack a hash, determine:

  • Where did it come from?
  • What system generated it?
  • What format is it?
  • Does it require preprocessing?
  • Is a salt involved?
  • Which John format supports it?

Understanding the credential source is often more important than memorizing another command.

Assuming the SAM File Is Enough

When analyzing offline Windows registry hives, the SAM and SYSTEM hives work together in the credential extraction process.

That is why our example exports both:

reg save HKLM\SAM SAM
reg save HKLM\SYSTEM SYSTEM

Forgetting --show

If John has already recovered the password, use:

john --show hashes.txt

rather than unnecessarily restarting the attack.

Assuming Every Password Can Be Cracked

There is no guarantee that a password can realistically be recovered.

Long, unique passwords combined with appropriate password-storage mechanisms can make cracking computationally impractical.

Security Implications

The Windows SAM example demonstrates an important defensive lesson.

Protecting the login screen is not enough if an attacker can obtain sensitive credential databases or registry hives.

Once credential material is copied from a compromised system, an attacker may be able to perform analysis completely offline.

That means controls such as account lockout policies may no longer help.

Defenders should therefore protect:

  • Administrative privileges
  • Registry hive access
  • Credential databases
  • Backups
  • System images
  • Endpoint security controls
  • Privileged accounts
  • Local administrator credentials

Password security should be treated as one layer of a broader credential-protection strategy.

Defensive Best Practices

Organizations can reduce password-related risk through several complementary controls:

  • Require long, unique passwords
  • Encourage password managers
  • Deploy multi-factor authentication
  • Protect privileged credentials
  • Restrict administrative access
  • Use modern password-storage mechanisms
  • Monitor credential-access activity
  • Protect backups and system images
  • Avoid password reuse
  • Use unique local administrator passwords

The goal is not simply to make John the Ripper unsuccessful.

The goal is to prevent an attacker from obtaining useful credential material in the first place while limiting the damage if credentials are compromised.

Building a Password Auditing Lab

A home cybersecurity lab is an excellent environment for practicing this workflow.

For example, you could use an authorized Windows virtual machine to learn:

Export SAM/SYSTEM
        |
        v
Transfer Lab Artifacts
        |
        v
Process with Impacket
        |
        v
Identify NT Hash
        |
        v
Audit with John
        |
        v
Analyze Password Strength

You can then repeat the exercise with Linux hashes, ZIP archives, and protected SSH keys.

This builds a much more valuable skill than simply memorizing:

john hashes.txt

You learn where credentials are stored, how they are protected, how tools extract them, and what defenders can do to reduce the risk.

Final Thoughts

John the Ripper is much more useful when understood as part of a complete password-auditing workflow.

On Windows, that workflow might begin with exported SAM and SYSTEM registry hives, continue through Impacket secretsdump, and end with an authorized John the Ripper password audit.

On Linux, it might involve passwd, shadow, and unshadow.

For protected files, the workflow may involve utilities such as zip2john or ssh2john.

The specific commands change, but the methodology remains remarkably consistent:

Locate
  |
  v
Extract
  |
  v
Identify
  |
  v
Prepare
  |
  v
Audit
  |
  v
Analyze

Understanding that process is the real skill.

It also demonstrates why credential security involves much more than choosing a complicated password. Defenders must protect the systems and files containing password hashes, limit privileged access, monitor credential theft, use multi-factor authentication, and assume that stolen hashes may eventually be subjected to offline attacks.

Key Takeaways

  • Main lesson: John the Ripper is most useful when understood as part of the complete credential-extraction and password-auditing process.
  • Important commands: john --wordlist, john --format, john --show, unshadow, zip2john, ssh2john, reg save, and impacket-secretsdump.
  • Windows skill practiced: Exporting SAM and SYSTEM hives and processing them with Impacket before auditing an NT hash.
  • Linux skill practiced: Preparing passwd and shadow data using unshadow.
  • Defensive consideration: Stolen password hashes can be attacked offline without interacting with normal authentication controls.
  • Best practice: Protect credential databases and privileged access while using long unique passwords, password managers, and multi-factor authentication.

References

For additional information, consult the official John the Ripper/Openwall documentation and the official Fortra Impacket documentation.

Useful commands for checking your local John installation include:

john --help

and, where supported:

john --list=formats

Similar Posts