Hashcat Password Cracking: A Safe, Step-by-Step Guide

Hashcat tests candidate passwords against password hashes, which can help you audit accounts or recover a password when you have authorization and a saved hash. You supply a hash file and identify its format; Hashcat reports a match only if a candidate produces the same hash. Use it only on hashes you own or have explicit permission to assess.

What You’ll Need

A computer running a supported version of Windows, Linux, or macOS, with Hashcat installed from its official project source.
A hash file containing hashes you are authorized to test. Keep it private; hashes can still expose sensitive information if cracked.
The correct hash type (Hashcat mode number), determined from the system or application that created it. A hash string alone may not identify its format reliably.
A wordlist or a carefully limited set of password candidates. Use only data you are permitted to use.
Basic familiarity with a terminal or command prompt. A compatible GPU can accelerate some hash types, but is not essential for a small test.

Step-by-Step

Confirm authorization and make a test copy. Work on a copy of the hash file, not the original account database. Store files in a private folder and avoid uploading hashes or recovered passwords to third-party services. If this is an organizational audit, agree on scope, handling, and deletion of results first.
Install and check Hashcat. Download the release for your operating system from the official Hashcat site and follow its installation instructions. Open a terminal in the installation folder and run hashcat --version. Then run hashcat -I to see whether supported compute devices are detected. If your system cannot find the command, use the full path to the executable or correct your PATH setting.
Prepare the hash file. Put one supported hash entry per line in a plain-text file, such as hashes.txt. Preserve any required salt or format fields exactly; do not add labels, spaces, or explanatory text unless the format expects them. Keep a backup and verify the file is readable from your terminal.
Identify the hash format before running a search. Consult the software’s documentation, configuration, or administrator to establish how the hash was made. Hashcat assigns each supported format a mode number. Check the official example-hashes and mode documentation for that format and compare the expected structure. Do not guess based only on the number of characters: different algorithms can produce similar-looking strings.
Choose a small, authorized candidate source. For a controlled test, use a short wordlist you created or are permitted to use. Hashcat’s basic wordlist attack takes the form hashcat -m MODE -a 0 hashes.txt wordlist.txt, replacing MODE with the verified numeric mode and the filenames with your own. Attack mode 0 means straight wordlist testing; it does not mean “no password.” Begin with a small list to confirm the setup.
Run the test and read the status. Start the command and watch its progress. Hashcat may show speed, progress, and an estimated time, but estimates vary with hardware, hash type, and candidate workload. A result indicates a candidate matched a hash; it does not prove the candidate is still valid for a live account. Stop with q when appropriate, or let a bounded test finish.
Review results safely. Use hashcat --show -m MODE hashes.txt to display recovered entries from the potfile, Hashcat’s local record of matches. Protect this output like a password file. Share only aggregated audit findings when possible, and securely remove temporary copies according to your organization’s retention rules.
Act on an authorized audit. If weak passwords were found, notify the responsible administrator through the agreed process. Recommend unique, long passwords and multifactor authentication, and have affected users reset credentials through the normal account process. Do not try recovered credentials against other services.

Common Mistakes

Using the wrong mode: A valid-looking hash can still be interpreted incorrectly. Verify the application and format rather than cycling through modes against an unknown target.
Assuming an unmatched hash is strong: A run that finds no candidate only means the tested candidates did not match. It does not establish that the password is uncrackable.
Misformatted input: Extra spaces, missing salts, or copied prefixes can make entries fail to parse. Check the documented input format and Hashcat’s warnings.
Expecting a GPU to fix everything: Some formats are memory-intensive or run better on particular hardware. Device detection alone does not guarantee a faster run.
Leaving recovered data exposed: Potfiles, terminal logs, and output files can contain plaintext passwords. Restrict access and remove them when no longer needed.

Tips

Test one known sample hash from documentation, where available, before processing sensitive data. This checks the installation and mode without probing a real account.
Keep candidate lists and run scope limited to the written authorization. Record the mode, Hashcat version, and test conditions so an audit can be repeated responsibly.
For defensive reviews, focus on password policy, password reuse risks, and improving storage practices rather than trying to obtain access to accounts.
Hashcat is a password recovery and auditing tool, not a way to decrypt a hash. Secure password systems use salts and slow password-hashing functions to make guessing more costly.

Troubleshooting

“No hashes loaded” or parsing errors: Check that the selected mode matches the exact input format, and inspect the file for blank lines, unexpected separators, or missing salt fields. Consult the mode documentation for required syntax.

No device is detected: Check hashcat -I, then install or update the appropriate graphics or compute driver using the device maker’s supported instructions. If no compatible device is available, Hashcat may be able to use the CPU; performance may be limited.

The run is extremely slow: Confirm the mode and device are correct, close unnecessary workloads, and begin with a smaller test list. Some hash functions are deliberately slow, so a low candidate rate can be expected.

No password is shown: Confirm that the input is valid and that your candidate list is relevant. A “not recovered” result is not a format diagnosis or a guarantee that no password can be found. Do not expand testing beyond your authorization.

Previously recovered results do not appear: Hashcat normally stores matches in a potfile. Check that you are using the same user account and potfile location, and run --show with the correct mode and hash file.

Frequently Asked Questions

Is Hashcat legal to use?
It depends on authorization and applicable rules. Use it only on your own hashes or within explicit permission and an agreed scope.

Can Hashcat recover every password?
No. It tests candidates; it cannot guarantee a match. Results depend on the password, hash format, available candidates, and resources.

Do I need a graphics card?
No. A compatible GPU can help with some workloads, but Hashcat may also run on a supported CPU. Performance varies by hash type and hardware.

What is a Hashcat mode number?
It identifies the hash format Hashcat should use. Choose it from the documented source format, not by guessing from the hash’s appearance.

Does Hashcat decrypt password hashes?
No. Hashes are one-way outputs. Hashcat tests candidate passwords by hashing them and comparing the result.

Where are recovered passwords stored?
Hashcat generally records matches in a potfile for later display with --show. Protect or remove that file because it may contain plaintext credentials.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →