John the Ripper is one of the most widely used offline password cracking tools in cybersecurity. It's used by authorized security professionals to test whether password hashes obtained through a legitimate audit process can be cracked, helping organizations understand how strong their password policies really are.
⚠️ Legal Notice: Only use John the Ripper against password hashes you own or have explicit written authorization to test — typically hashes extracted from your own systems as part of an approved security audit. Attempting to crack credentials you don't have permission to test is illegal in most countries.
On this page:
John the Ripper ("JtR") is a free, open-source password cracking tool originally released in 1996. Unlike Hydra, which tests live login attempts over a network, John the Ripper works offline — it takes password hashes that have already been obtained (through an authorized audit or export) and attempts to recover the original password from them.
It supports a huge range of hash types, from simple Unix crypt hashes to Windows NTLM, and is a standard tool taught in most penetration testing courses and certifications.
This is the key distinction that trips up beginners: online tools like Hydra send login attempts over the network to a live service, which is slow and easily rate-limited or locked out. Offline tools like John the Ripper work directly against a hash file with no network involved, so they can attempt millions of guesses per second, limited only by hardware — which is exactly why protecting hash files (and how they're stored) matters so much.
General usage format:
The example below uses a placeholder filename representing hashes exported from your own authorized lab environment:
The first command attempts to crack the hashes using a common wordlist; the second displays any that were successfully recovered.
| Tool | Processing | Best For |
|---|---|---|
| John the Ripper | CPU-based (with some GPU support) | Broad hash-type support, flexible rule-based cracking |
| Hashcat | GPU-accelerated | Raw cracking speed on large hash sets |
Many professionals use both — John the Ripper for its flexible rule engine and format support, Hashcat when raw speed on a large hash set matters most.
Yes, when used against hashes you own or have written authorization to test.
Yes, the core tool is free and open-source; there's also a paid "Pro" version with additional features and support.
Hydra attacks live login services over a network. John the Ripper cracks password hashes offline, after they've already been obtained.
Long, random passwords combined with strong hashing algorithms like bcrypt can make cracking computationally infeasible even with unlimited time.
John the Ripper is a foundational tool for understanding password hash security — always within a legal, authorized scope. Learning it helps you evaluate real password strength and choose better hashing and policy practices.