John the Ripper — Password Security Auditing Tool

Introduction

John the Ripper is one of the most widely used password security auditing tools, originally developed by Openwall. It combines multiple cracking modes (wordlist, incremental, rules-based) with support for hundreds of hash and cipher types. Security teams use it to verify password policy compliance and identify weak credentials before attackers do.

What John the Ripper Does

• Cracks password hashes from operating systems (Unix, Windows NTLM, macOS), databases, and applications
• Supports over 300 hash formats in the community-enhanced jumbo version including bcrypt, SHA-crypt, and PBKDF2
• Applies intelligent wordlist rules to generate password variations from base dictionaries
• Uses incremental (brute-force) mode with configurable character sets and length ranges
• Leverages GPU acceleration via OpenCL for computationally intensive hash types

Architecture Overview

John the Ripper is written in C with optional OpenCL kernels for GPU acceleration. The core engine manages a cracking session that coordinates multiple attack modes: single crack mode (uses login information), wordlist mode (dictionary with mangling rules), and incremental mode (systematic brute-force). The jumbo version adds a plugin-like format system where each hash type is a self-contained module implementing detection, parsing, and comparison functions. Session state is saved automatically for resumable cracking.

Self-Hosting & Configuration

• Available in most Linux distribution repositories; the jumbo version provides the widest format support
• Build from source with ./configure && make in the src/ directory for the latest features
• Configuration lives in john.conf controlling rules, incremental character sets, and external modes
• GPU support requires OpenCL drivers installed for the target hardware
• Session management stores progress in .rec files for automatic resume after interruption

Key Features

• Auto-detects hash formats from input files, reducing manual identification work
• Supports session save and restore for long-running jobs across reboots
• Rules engine transforms wordlist entries with over 100 built-in mangling operations
• Multi-CPU and multi-GPU parallelism for high-throughput auditing
• Processes common file formats directly: ZIP, RAR, PDF, SSH keys, KeePass databases, and office documents

Comparison with Similar Tools

• Hashcat — GPU-focused cracker with generally faster GPU performance; John offers better CPU performance and broader format support out of the box
• Hydra — an online brute-forcer attacking live services; John works offline against extracted hashes
• CrackStation — online hash lookup service; John runs locally without sending hashes to third parties
• Ophcrack — specializes in Windows LM/NTLM hashes using rainbow tables; John covers far more hash types with multiple attack modes

FAQ

Q: What is the difference between John and the Jumbo version? A: The jumbo version is a community-enhanced build that adds support for hundreds of additional hash formats, GPU acceleration, and extra features beyond the original core release.

Q: Can John the Ripper use GPU acceleration? A: Yes, the jumbo version supports OpenCL for GPU-accelerated cracking of supported hash types including bcrypt, SHA-512, and WPA/WPA2.

Q: How do I extract hashes from files for John to crack? A: John includes helper scripts like zip2john, rar2john, pdf2john, and ssh2john that extract crackable hashes from encrypted files.

Q: Is it legal to use John the Ripper? A: John is legal to possess and use on systems and data you own or have explicit written authorization to test. Unauthorized password cracking is illegal in most jurisdictions.

Sources

• https://github.com/openwall/john
• https://www.openwall.com/john/