John the Ripper Tutorial: The 2026 Password Auditing Guide

Complex password strength is fundamentally one of the most critical elements of user account security. In professional cybersecurity auditing, we use offline password cracking tools to test if stored password hashes can be cracked using dictionary attacks or brute force. John the Ripper (JTR) is the industry-standard, open-source tool designed for password strength auditing and cryptographic recovery.

In this tutorial for beginners, you will learn how to securely set up John the Ripper from scratch, extract encrypted hashes from corporate systems, use wordlists to speed up recovery, and enforce strict password policies within your organization.

We will cover:

• What John the Ripper is and how its underlying cryptography works.
• Installing JTR on Windows, Linux, and macOS.
• Extracting and cracking Linux user hashes (mastering the unshadow command).
• Performing advanced wordlist and rule-based attacks.
• Setting up GPU acceleration for faster cracking speeds.

What is John the Ripper?

John the Ripper is a specialized offline password cracker. Unlike online brute-forcing tools such as THC-Hydra (which log in to interactive protocols like SSH or standard FTP), John the Ripper operates on a static database of encrypted password hashes stored locally.

How Offline Cracking Works:

1. The Hash File: The security auditor gains privileged access to the internal database of hashed credentials (e.g., the Windows Active Directory database, the Linux /etc/shadow file, or raw SQL database exports).
2. Payload Generation: JTR takes candidate words (like password123) and runs them through the identical cryptographic hashing algorithm (like SHA-512, legacy MD5, or salted bcrypt) that was originally used to encrypt the target hashes.
3. The Comparison: JTR compares the newly generated hash with the target hash. If they match bit-for-bit, the password has been cracked.

Because this process happens 100% offline, there are no lockout policies, zero network latency, and no logging systems to stop the auditor from testing millions, or even billions, of passwords per second. You can capture authentication handshakes from raw network traffic using tools like Wireshark and extract the hashes to crack them offline with John.

How to Install John the Ripper

For professional security audits, you should install the John the Ripper Jumbo version. The Jumbo version includes community additions, support for hundreds of new hash formats, and GPU hardware acceleration.

🐧 Linux

On standard Debian-based systems (like Ubuntu and Kali Linux):

sudo apt update
sudo apt install john -y

🍎 macOS

macOS users can install the Jumbo version using the Homebrew package manager:

brew update
brew install john-jumbo

🪟 Windows

1. Download the pre-built compiled binaries from the official Openwall Site.
2. Extract the downloaded ZIP file.
3. The compiled executables are located in the /run folder. Open the Command Prompt, navigate to the /run folder, and execute commands from there.

Step-by-Step Tutorial: Cracking Your First Password Hash

Let’s walk through how to audit local Linux user passwords. Linux systems separate the public user listing from the cryptographic password hashes. The user details are in /etc/passwd (publicly readable), while the salted password hashes are stored in /etc/shadow (readable only by the root user).

Step 1: Combine Passwd and Shadow (Unshadow)

Before John can crack the hashes, it needs the username and the cryptographic hash combined into a single formatted file. We use the unshadow utility for this:

sudo unshadow /etc/passwd /etc/shadow > hashes.txt

This merges the files and outputs them into a new file named hashes.txt.

Step 2: Run John in Default Mode

JTR has an automated default mode called “Single Crack Mode” followed by wordlist modes. Run it on the extracted file:

john hashes.txt

John will automatically detect the hash type (e.g., sha512crypt) and start matching candidate passwords at high speeds.

Step 3: Show Cracked Passwords

To view the results of the cracked passwords, run:

john --show hashes.txt

The terminal will display the username and password matches side-by-side.

Advanced Password Auditing: Wordlists and Rules

Running John in its default mode is effective for basics, but for corporate audits, you need targeted wordlists. The most popular wordlist in security testing is rockyou.txt, containing over 14 million compromised real-world passwords.

1. Using a Specific Wordlist

To feed a custom targeted wordlist to JTR:

john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt

2. Implementing Mangling Rules

Users often take standard dictionary words and predictably modify them (e.g., adding 123! to the end, or replacing the letter E with the number 3). John has an internal rules engine that automatically applies these modifications (called mangling) to every word in your wordlist:

john --rules --wordlist=company_keywords.txt hashes.txt

3. Specifying the Hash Format

If you know the exact hash format (e.g., NTLM hashes from Windows Active Directory environments), specifying it speeds up the process significantly because JTR doesn’t waste processing time trying to auto-detect the cryptographic signature:

john --format=NT hash_file.txt

Common format flags include raw-md5, raw-sha1, NT, md5crypt, and bcrypt.

Speeding Up Cracking with GPU Acceleration

Complex, intentionally slow password hashes (like bcrypt or argon2) are designed to be computationally expensive. Cracking them on a standard CPU can take decades or centuries. The John the Ripper Jumbo version supports OpenCL, enabling you to offload the mathematical computation directly to high-performance graphic cards (GPUs).

To list all your available GPU hardware devices:

john --list=opencl-devices

To run a scan using OpenCL acceleration:

john --format=wpapsk-opencl --wordlist=rockyou.txt wpa_handshake.txt

Defensive Best Practices: Rendering John Useless

If you are a systems administrator or software engineer, you should implement these protocols to ensure your user databases are uncrackable:

1. Use Strong Hashing Algorithms: Never use obsolete algorithms like raw MD5 or SHA-1. Use strong, modern key derivation functions like Argon2id, bcrypt, or scrypt.
2. Enforce Cryptographic Salting: Append a random cryptographic salt to every user password before hashing it. This prevents the use of pre-computed Rainbow Tables.
3. Enforce Strict Password Policies: Require a minimum password length (at least 14 characters, preferably more). Reject all common passwords against known breach lists (using services like the HaveIBeenPwned API during the registration process).

Ethical Use Warning

⚠️ IMPORTANT LEGAL WARNING: Password cracking is an intrusive action. You must only audit password hashes that you legally possess ownership over, or corporate systems where you possess formal, written legal authorization (such as a legally binding Penetration Testing Agreement). Running password crackers on unauthorized hashes is a criminal violation of computer misuse laws globally.

Frequently Asked Questions (FAQ)

Q: What is John the Ripper (JTR)?
A: John the Ripper is an industry-standard, open-source offline password cracking tool used by cybersecurity professionals for password strength auditing and cryptographic recovery.

Q: How does offline password cracking differ from online brute-forcing?
A: Offline password cracking operates on a static local database of encrypted hashes without interacting with live network protocols. This means there are no account lockouts, no network latency, and no logs generated, allowing auditors to test millions of passwords per second.

Q: What is the unshadow command used for in Linux password auditing?
A: The unshadow utility merges the publicly readable /etc/passwd file with the restricted /etc/shadow file. This combines the usernames with their corresponding salted cryptographic hashes into a single file formatted for John the Ripper to process.

Q: How do I use a custom wordlist with John the Ripper?
A: You can use a custom wordlist by adding the --wordlist flag to your command. For example, to use the popular rockyou.txt wordlist, you would run: john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt.

Q: Why should I use GPU acceleration for password cracking?
A: Complex hashing algorithms like bcrypt and argon2 are computationally expensive. Utilizing GPU acceleration through OpenCL allows you to offload the mathematical processing to high-performance graphics cards, drastically increasing your cracking speed compared to a standard CPU.

Conclusion: The Auditor

John the Ripper is an essential and powerful tool in the security practitioner’s arsenal. By understanding how to merge hash directories, run optimized dictionary attacks, apply mangling rules, and leverage GPU computational power, you can audit your internal network accounts to ensure no user is utilizing weak or compromised network credentials.