Reference articles on history, science, culture and more
Surprise meSurprise meSubscribe
Encyclopedia

Hashcat

Open-source password recovery tool

Wikipedia contributorsAdapted for Fathomly · View authors
3 min read
Source updated April 15, 2026

Hashcat is a password recovery tool. It had a proprietary code base until 2015, but was then released as open source software. Versions are available for Linux, macOS, and Windows. Examples of hashcat-supported hashing algorithms are LM hashes, MD4, MD5, SHA-family and Unix Crypt formats as well as algorithms used in MySQL and Cisco PIX.

Hashcat has received publicity because it is partly based on flaws in other software discovered by its creator. An example was a flaw in 1Password's password manager hashing scheme. It has also been compared to similar software in a Usenix publication and been described on Ars Technica.

01Variants

Previously, two variants of hashcat existed:

  • hashcat - CPU-based password recovery tool
  • oclHashcat/cudaHashcat - GPU-accelerated tool (OpenCL or CUDA)

With the release of hashcat v3.00, the GPU and CPU tools were merged into a single tool called hashcat. The CPU-only version became hashcat-legacy. Both CPU and GPU now require OpenCL.

Many of the algorithms supported by hashcat-legacy (such as MD5, SHA1, and others) can be cracked in a shorter time with the GPU-based hashcat. However, not all algorithms can be accelerated by GPUs. Bcrypt is an example of this. Due to factors such as data-dependent branching, serialization, and memory (and more), oclHashcat/cudaHashcat weren't catchall replacements for hashcat-legacy.

hashcat-legacy is available for Linux, OSX and Windows. hashcat is available for macOS, Windows, and Linux with GPU, CPU and generic OpenCL support which allows for FPGAs and other accelerator cards.

02Sample output

hashcat (v7.0.0) starting CUDA API (CUDA 12.9) ==================== * Device #01: NVIDIA GeForce RTX 4090, 23687/24080 MB, 128MCU * Device #02: NVIDIA GeForce RTX 4090, 23687/24080 MB, 128MCU OpenCL API (OpenCL 3.0 CUDA 12.9.76) - Platform #2 [NVIDIA Corporation] ======================================================================= * Device #04: NVIDIA GeForce RTX 4090, skipped * Device #05: NVIDIA GeForce RTX 4090, skipped Minimum password length supported by kernel: 0 Maximum password length supported by kernel: 256 Minimum salt length supported by kernel: 0 Maximum salt length supported by kernel: 256 Hashes: 1 digests; 1 unique digests, 1 unique salts Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates Optimizers applied: * Zero-Byte * Single-Hash * Single-Salt * Brute-Force * Slow-Hash-DimensionY-LOOP Watchdog: Temperature abort trigger set to 90c Host memory allocated for this attack: 512 MB (164979 MB free) $argon2id$v=19$m=65536,t=3,p=1$FBMjI4RJBhIykCgol1KEJA$2ky5GAdhT1kH4kIgPN/oERE3Taiy43vNN70a3HpiKQU:hashcat Session..........: hashcat Status...........: Cracked Hash.Mode........: 34000 (Argon2) Hash.Target......: $argon2id$v=19$m=65536,t=3,p=1$FBMjI4RJBhIykCgol1KE...HpiKQU Time.Started.....: Fri Aug 1 14:07:43 2025 (14 secs) Time.Estimated...: Fri Aug 1 14:07:57 2025 (0 secs) Kernel.Feature...: Pure Kernel (password length 0-256 bytes) Guess.Mask.......: ?l?l?l?lcat [7] Guess.Queue......: 1/1 (100.00%) Speed.#01........: 1699 H/s (17.23ms) @ Accel:354 Loops:1 Thr:32 Vec:1 Speed.#02........: 1696 H/s (17.21ms) @ Accel:354 Loops:1 Thr:32 Vec:1 Speed.#*.........: 3395 H/s Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new) Progress.........: 45666/456976 (9.99%) Rejected.........: 0/45666 (0.00%) Restore.Point....: 1062/17576 (6.04%) Restore.Sub.#01..: Salt:0 Amplifier:12-13 Iteration:11-12 Restore.Sub.#02..: Salt:0 Amplifier:12-13 Iteration:10-11 Candidate.Engine.: Device Generator Candidates.#01...: htrecat -> hoelcat Candidates.#02...: hepacat -> hbencat Hardware.Mon.#01.: Temp: 53c Fan: 30% Util: 99% Core:2790MHz Mem:10251MHz Bus:16 Hardware.Mon.#02.: Temp: 51c Fan: 30% Util: 99% Core:2715MHz Mem:10251MHz Bus:8 Started: Fri Aug 1 14:07:35 2025 Stopped: Fri Aug 1 14:07:58 2025

03Attack types

Hashcat offers multiple attack modes for obtaining effective and complex coverage over a hash's keyspace. These modes are:

  • Brute-force attack
  • Combinator attack
  • Dictionary attack
  • Fingerprint attack
  • Hybrid attack
  • Mask attack
  • Permutation attack
  • Rule-based attack
  • Table-Lookup attack (CPU only)
  • Toggle-Case attack
  • PRINCE attack (in CPU version 0.48 and higher only)

The traditional bruteforce attack is considered outdated, and the Hashcat core team recommends the Mask-Attack as a full replacement.

04Competitions

Team Hashcat (the official team of the Hashcat software composed of core Hashcat members) won first place in the KoreLogic "Crack Me If you Can" Competitions at DefCon in 2010, 2012, 2014, 2015, and 2018, and at DerbyCon in 2017.

Watch videos about HashcatExplainers and documentaries on YouTube (opens in a new tab)

Sources and credits

This article is adapted from the Wikipedia article “Hashcat”, written by its contributors and licensed under CC BY-SA 4.0. Fathomly has changed the layout, removed citation markers, navigation and maintenance notices, and adjusted punctuation. This adapted version is shared under the same license. For references, see the original article.

Fathomly is not affiliated with or endorsed by the Wikimedia Foundation. Spotted a problem? Tell us.

Continue exploring

Related topics

Brute-force attack

In cryptography, a brute-force attack or exhaustive key search is a cryptanalytic attack that consists of an attacker submitting many possible keys or passwords with the hope of eventually guessing correctly. This strategy can theoretically be used to break any form of encryption that is not information-theoretically secure.

Brute-force search

In computer science, brute-force search or exhaustive search, also known as generate and test, is a very general problem-solving technique and algorithmic paradigm that consists of systematically checking all possible candidates for whether or not each candidate satisfies the problem's statement. A brute-force algorithm that finds the divisors of a natural number n would enumerate all integers from 1 to n, and check whether each of them divides n without remainder.

Security hacker

A security hacker or security researcher is someone who explores methods for breaching or bypassing defenses and exploiting weaknesses in a computer system or network. Hackers may be motivated by a multitude of reasons, such as profit, protest, sabotage, information gathering, challenge, recreation, or evaluation of a system weaknesses to assist in formulating defenses against potential hackers.