Our AI strategy for preemptive security
John the Ripper is an open-source password-auditing tool that tests how easily password hashes can be cracked, supporting hundreds of hash formats. Security teams use it in authorized engagements to find weak credentials before attackers do.
John the Ripper jumbo supports many cipher and hash types. This includes the user passwords for all of the Unix variants (Linux, *BSD, Solaris, AIX, QNX, etc.), macOS, Windows, network traffic captures (Windows network auth, WiFi WPA-PSK, and more), encrypted private keys, filesystems and disks, archive formats (ZIP, RAR, etc.), certain web applications such as WordPress, groupware, and database servers such as SQL and LDAP, and document files such as Adobe PDF, Microsoft 365 Office, and more.
Ethical hackers and penetration testers prefer John the Ripper software because of its ability to detect password hash types automatically. JTR can run several types of attacks to include the classic dictionary attack as well as a brute force attack. JTR also offers a business version of the product called “John the Ripper Professional.” You can download JTR here.
In an authorized assessment, John the Ripper helps teams test whether captured or provided password hashes are protected by strong password policy and modern hashing practices. A useful finding should not stop at ‘the hash cracked’; it should explain the pattern that made cracking possible, the affected account class, and the remediation path, such as longer passphrases, MFA, breached-password screening, lockout controls, or stronger password hashing.
A dictionary attack attempts unauthorized entry to a computer using dictionary words or some other library of terms to generate variations of possible passwords. A brute force attack uses trial and error to break passwords. A password spray attack uses a popular password or set of popular passwords in an attempt to discover one that will work. In any case, when a password is identified, credential stuffing, or trying the newly found password across all of the websites associated with that user, may also net additional successfully breached data.
The difference with a brute force attack is that a very large number of key possibilities must be checked. In the dictionary attack, only words with the greatest possibility of success are tested. For this reason, dictionary attacks generally consume less time than brute force attacks.
The rate at which John the Ripper will guess the password is going to depends on the password’s strength and the offered wordlist. JTR will keep attempting to break the password continuously unless there is a termination command.
John the Ripper is fast and replete with many key features. JTR combines several cracking modes in one program and is fully configurable. Also, JTR is available for several different platforms which enables you to use the same password cracking tool everywhere.
John the Ripper supports and detects the following Unix crypt(3) hash types:
You can protect your organization from password cracking attacks by following ways:
Long passwords alone will not completely stop a brute force attack. Threat actors will often combine brute force attacks with a dictionary attack. The password breaking process will start with a brute force attack. This brute force attack is designed to try every possible password combination up to a certain length which may be about four to six characters. Once that is done, the software algorithms then use dictionary words to break any passwords that were not compromised through brute force.
Sometimes the organization’s minimum password length is determined through social engineering. In the event that an attacker learns that an organization requires a minimum password length of eight characters that is critical information. In that case, the attacker doesn’t need to work on breaking smaller passwords. This reduction in the number possible solutions shotends the time to perform a brute force attack.
What is John the Ripper used for?
John the Ripper is used to audit password hashes and test whether passwords are likely to be cracked. Security teams use it in authorized engagements to identify weak credentials and improve password controls.
Is John the Ripper legal?
John the Ripper is legal when used for authorized password auditing, such as testing your own systems or an approved engagement. Using it against stolen hashes or accounts without permission is not legitimate security testing.
John the Ripper vs Hashcat: which is better?
Both are password-auditing tools. John the Ripper is known for broad hash-format support and flexible modes, while Hashcat is often used for high-performance GPU workflows. The better choice depends on the hash type, hardware, and engagement goals.
Want to learn more? Check out our FREE Bugcrowd University to sharpen your hacking skills.
Organizations the world over need your help! Join our researcher community to connect with hundreds of organization programs focused on finding their security vulnerabilities. Our vast directory includes programs for all skill levels, across many industries and from around the world.
Hackers aren’t waiting, so why should you? See how Bugcrowd can quickly improve your security posture.