Hashcat Tutorial for Kali Linux 2026

What is Hashcat?

Hashcat is the world's fastest password recovery tool. It uses GPU compute (CUDA on NVIDIA, OpenCL on AMD) to test billions of password candidates per second against captured password hashes. On an RTX 4090, it cracks MD5 at 164 billion hashes per second — meaning the entire 14-million-entry rockyou.txt wordlist completes in under a millisecond.

Hashcat supports over 300 hash types — MD5, SHA-1, SHA-256, NTLM (Windows), bcrypt, scrypt, WPA2 handshakes, Kerberos tickets, KeePass databases, encrypted PDF/ZIP/Office files, and modern algorithms like Argon2. It's pre-installed on Kali Linux and is one of the essential Kali Linux tools in any pentester's arsenal.

How Hashcat Works

Hashcat doesn't "reverse" hashes — that's mathematically impossible. Instead, it does the same thing the original hashing system does: takes a candidate password, hashes it, and compares the result to your target hash. If they match, you've found the password.

The speed comes from doing this billions of times per second in parallel on a GPU. The technique that finds passwords comes from choosing good candidates — that's where attack modes, rules, and masks come in.

Installing & Verifying Hashcat

Hashcat ships pre-installed on Kali Linux. Verify it's there and that your GPU is detected:

If apt update fails with a signing-key or repository error, see how to fix broken Kali updates. If the terminal itself is new to you, the beginner commands guide covers the basics every example below assumes.

Hashcat Basic Syntax

Every hashcat command follows this pattern:

The two most important flags:

• -m = hash mode (what kind of hash you're cracking — MD5 is 0, NTLM is 1000, WPA2 is 22000, etc.)
• -a = attack mode (how to generate candidates — dictionary, brute-force, hybrid, etc.)

The 6 Attack Modes

Hashcat has six attack modes. You'll use modes 0, 3, and 6 most often:

Common Hash Modes (the -m flag)

Hashcat supports over 300 hash types. Here are the ones you'll actually encounter:

If you don't know what hash type you have, use a hash identifier tool:

Dictionary Attack (-a 0) — Start Here

The dictionary attack is the most common — and most successful — type. You give hashcat a list of candidate passwords and it tries each one. If the password is in the list, you crack it.

Cracking an MD5 hash with rockyou.txt

You'll see hashcat initialize, then crack the hash. Output looks like:

The cracked password is shown right after the hash, separated by a colon: password.

Cracking multiple hashes at once

Put one hash per line in a file. Hashcat will crack them all in parallel — at no speed penalty.

Rule-Based Attacks (The Real Power)

This is where hashcat shines. Rules tell hashcat to automatically mutate each wordlist entry — appending years, capitalizing, substituting characters, reversing. A single wordlist entry like password becomes Password, password1, p@ssword, PASSWORD123, drowssap, and hundreds more.

Best64.rule generates 64 variations of each word. Applied to rockyou.txt's 14 million entries, that's nearly 1 billion candidates — without storing them on disk.

Mask Attack (-a 3) — Brute-Force With Patterns

When you know something about the password's structure — like "it's 8 digits" or "it starts with a capital letter" — a mask attack is far more efficient than pure brute-force. You build a pattern from character placeholders:

Custom charsets

For patterns that don't fit the built-in charsets, define your own with -1 through -4:

Hybrid Attacks (-a 6 and -a 7)

Hybrid attacks combine a wordlist with a mask. They're often the most effective real-world attack because people constantly append numbers or years to common words.

Real-World Examples

Let's go through the most common scenarios you'll actually hit.

Cracking NTLM hashes (Windows passwords)

NTLM hashes come from mimikatz, secretsdump, the Windows SAM database, or NTLM relay attacks. They're fast to crack — RTX 4090 hits ~288 GH/s.

Cracking Linux /etc/shadow

Modern Linux uses sha512crypt ($6$ prefix). It's intentionally slow to crack — by design.

Cracking WPA2 WiFi handshakes

Mode 22000 handles both 4-way handshakes and PMKID captures. Capturing one in the first place needs a wireless card that supports monitor mode — see my guide to the best WiFi adapters for Kali Linux. For the full capture-to-crack workflow, see my WPA2 cracking tutorial.

Cracking encrypted files (ZIP, Office, KeePass)

For these, you extract the password hash from the file first using a helper script from John the Ripper:

GPU Benchmarks & Performance Tuning

Run hashcat -b for a full benchmark of your hardware across all hash types. Here are typical 2026 speeds on common GPUs:

Numbers are approximate — actual speed varies with hashcat version, drivers, system load, and exact silicon. Use hashcat -b to test your own hardware.

Performance flags

Session Management

Cracking sessions often take hours or days. Hashcat lets you pause, resume, and run multiple sessions in parallel.

Attack Strategy: What To Try First

The order I work through attacks on a new set of hashes:

1. Identify the hash type with hashid if unclear
2. Pure dictionary with rockyou.txt (5 seconds on a fast GPU — try it first)
3. Dictionary + best64.rule (catches the majority of weak passwords)
4. Dictionary + dive.rule (more aggressive mutations)
5. Targeted wordlist + rules (SecLists, leaked databases, company-specific terms)
6. Hybrid attack with year/digit suffix (people love "password2024")
7. Mask attack on known patterns (router defaults are often 8 digits)
8. Pure brute-force (only for short passwords on fast hash types)

Hashcat vs John the Ripper

The two big password crackers are hashcat and John the Ripper. They're often compared, but they're complementary tools — pros use both.

Real workflow: use John for hash identification and to extract hashes from encrypted files (its *2john scripts are unmatched). Then run the actual cracking on hashcat for GPU speed.

Common Issues & Troubleshooting

"No devices found / no usable devices"

Hashcat can't find your GPU. Causes: outdated drivers, missing CUDA toolkit (NVIDIA), or running in a VM without GPU passthrough. Check with hashcat -I. On Linux, install nvidia-cuda-toolkit if missing. In a VM, you'll likely need to run on the host instead.

"Hashfile 'xxx' on line N: Token length exception"

The hash format doesn't match the mode you specified. Either the wrong -m, extra whitespace in the hash file, or hashes mixed with non-hash content. Run hashid 'your-hash' to verify the type, and make sure the file has one clean hash per line.

"Cracking takes forever"

The expected speed depends on hash type and hardware. hashcat -b -m [mode] tells you what your hardware achieves on that hash. If actual speed is much slower than the benchmark, you're running CPU fallback (not GPU). Check hashcat -I. If actual speed matches benchmark and it's still slow, the candidate space is just too large — switch attack modes or get better wordlists.

"GPU temperature triggered abort"

Your GPU got too hot. Improve case cooling, reduce workload from -w 3 to -w 2, or raise the abort threshold (--hwmon-temp-abort=85 — but don't go above 85°C on consumer cards).

"Hashcat found 0/N digests"

Hashcat ran successfully but didn't crack anything. The password isn't in your wordlist (try more wordlists, add rules, try a mask attack), or the hash format is wrong (try a different -m).