hashcat

hashcat is a command-line password recovery and hash cracking tool that runs on GPUs, CPUs, and distributed systems. It supports Linux, Windows and macOS, and uses CUDA, HIP, Metal or OpenCL backends. Several devices, including mixed device types, can be used in a single system, and many hashes can be cracked at once. It ships with over 590 hash modes and a built-in benchmark.

It provides 10 attack modes: wordlist, combination, brute-force, PCFG, table, two hybrid modes, a mask mode that specifies where the word goes, generic plugin feeds, and association. Candidates can come from a wordlist, stdin, or another program. It also includes an in-kernel rule engine, Markov chain keyspace ordering so likely candidates are tried first, and hex salt and hex charset support for non-text data.

Operational features include automatic per-device performance tuning, interactive pause and resume, named sessions with restore after interruption, and a thermal watchdog. Brain skips candidates that an earlier session already tried, and distributed cracking networks use an overlay. Encrypted plains let someone crack a hash for another party without being able to read the password. Keyboard layout mapping covers full disk encryption passwords typed on non-US keyboards. The assimilation bridge lets developers add a hash mode in C, Python or Rust without writing a kernel.

It is used by security professionals, penetration testers, and researchers doing password auditing or recovery. Help is available through --help, and the repository includes one example hash per mode in its docs.