# Hashcat — Practical Guide

<div style="background: linear-gradient(135deg, #0d0d0d 0%, #1a0a2e 50%, #2d1b69 100%); color: #e0e0e0; padding: 18px 24px; border-radius: 10px; margin-bottom: 24px;">
  <strong style="color:#ff6b35; font-size:1.1em;">Hashcat</strong> is the world's fastest password recovery tool. Unlike John the Ripper — which runs primarily on CPU — hashcat is built around <strong>GPU acceleration</strong>, achieving cracking speeds orders of magnitude higher than CPU-based tools.
  <br><br>
  <span style="color:#a8dadc;">This guide uses <strong>hashcat v7.1.2</strong> installed via Homebrew. All commands are designed to be run from a macOS/Linux terminal.</span>
  <br><br>
  <span style="color:#aaa;">⚠️ On macOS with Apple Silicon, hashcat uses the <strong>Metal</strong> backend instead of CUDA/OpenCL. Performance is good, but some GPU-specific options may behave differently than on dedicated NVIDIA hardware.</span>
</div>

---


## Table of Contents

1. [Help and version](#1-help-and-version)
2. [Hash types — the `-m` flag](#2-hash-types--the--m-flag)
3. [Identifying an unknown hash](#3-identifying-an-unknown-hash)
4. [Preparing a hash file](#4-preparing-a-hash-file)
5. [Attack modes — the `-a` flag](#5-attack-modes--the--a-flag)
6. [Brute force (attack mode 3)](#6-brute-force-attack-mode-3)
7. [Wordlist attack (attack mode 0)](#7-wordlist-attack-attack-mode-0)
8. [Wordlist + rules (attack mode 0 + `-r`)](#8-wordlist--rules-attack-mode-0---r)
9. [Custom rule](#9-custom-rule)
10. [Hybrid attacks (modes 6 and 7)](#10-hybrid-attacks-modes-6-and-7)
11. [Combination attack (attack mode 1)](#11-combination-attack-attack-mode-1)
12. [Custom charsets](#12-custom-charsets)
13. [Benchmarking](#13-benchmarking)

---

## 1. Help and version

```bash
hashcat --version       # print version only
hashcat -h              # show common options and attack modes
hashcat -hh             # show ALL supported hash modes (long list)
```

To also view backend (GPU/CPU) information:

```bash
hashcat -I              # basic backend info
hashcat -II             # detailed backend info
```

---

## 2. Hash types — the `-m` flag

Every hashcat command requires specifying the hash type with `-m <number>`.
This is the most important difference from John, which auto-detects formats.

Most commonly used hash modes:

<table style="border-collapse: collapse; width: 100%; margin: 12px 0;">
  <thead>
    <tr style="background: #1a0a2e; color: white;">
      <th style="padding: 8px 14px; text-align: left;">-m</th>
      <th style="padding: 8px 14px; text-align: left;">Hash type</th>
      <th style="padding: 8px 14px; text-align: left;">Example hash</th>
    </tr>
  </thead>
  <tbody>
    <tr style="background:#f5f5f5;"><td style="padding:7px 14px;"><code>0</code></td><td style="padding:7px 14px;">MD5</td><td style="padding:7px 14px;"><code>5f4dcc3b5aa765d61d8327deb882cf99</code></td></tr>
    <tr><td style="padding:7px 14px;"><code>100</code></td><td style="padding:7px 14px;">SHA-1</td><td style="padding:7px 14px;"><code>5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8</code></td></tr>
    <tr style="background:#f5f5f5;"><td style="padding:7px 14px;"><code>1400</code></td><td style="padding:7px 14px;">SHA-256</td><td style="padding:7px 14px;"><code>5e884898da28...</code></td></tr>
    <tr><td style="padding:7px 14px;"><code>1700</code></td><td style="padding:7px 14px;">SHA-512</td><td style="padding:7px 14px;"><code>b109f3bbbc...</code></td></tr>
    <tr style="background:#f5f5f5;"><td style="padding:7px 14px;"><code>1000</code></td><td style="padding:7px 14px;">NTLM (Windows)</td><td style="padding:7px 14px;"><code>8846f7eaee8fb117...</code></td></tr>
    <tr><td style="padding:7px 14px;"><code>3200</code></td><td style="padding:7px 14px;">bcrypt</td><td style="padding:7px 14px;"><code>$2a$12$...</code></td></tr>
    <tr style="background:#f5f5f5;"><td style="padding:7px 14px;"><code>500</code></td><td style="padding:7px 14px;">MD5crypt (Linux <code>$1$</code>)</td><td style="padding:7px 14px;"><code>$1$salt$hash</code></td></tr>
    <tr><td style="padding:7px 14px;"><code>1800</code></td><td style="padding:7px 14px;">sha512crypt (Linux <code>$6$</code>)</td><td style="padding:7px 14px;"><code>$6$salt$hash</code></td></tr>
    <tr style="background:#f5f5f5;"><td style="padding:7px 14px;"><code>13400</code></td><td style="padding:7px 14px;">KeePass</td><td style="padding:7px 14px;">extracted with keepass2john</td></tr>
    <tr><td style="padding:7px 14px;"><code>22000</code></td><td style="padding:7px 14px;">WPA2 (WiFi)</td><td style="padding:7px 14px;">.hc22000 capture file</td></tr>
  </tbody>
</table>

To search for a specific format by name:

```bash
hashcat -hh | grep -i bcrypt
hashcat -hh | grep -i ntlm
hashcat -hh | grep -i sha256
```

---

## 3. Identifying an unknown hash

When you have a hash but don't know its type, use `--identify`:

```bash
hashcat --identify hashes.txt
```

Or, for a single hash passed directly:

```bash
echo "5f4dcc3b5aa765d61d8327deb882cf99" | hashcat --identify
```

<div style="background:#fff8e1; border-left: 4px solid #f9a825; padding: 12px 16px; border-radius: 0 6px 6px 0; margin: 12px 0;">
  <strong>💡 Tip:</strong> For more reliable hash identification, you can also use external tools like <code>hashid</code> or <code>hash-identifier</code>, which are more specialised and can distinguish formats that look identical (e.g. MD5 vs. NTLM).
</div>

---

## 4. Preparing a hash file

Hashcat accepts hashes one per line, with an optional username prefix:

```
5f4dcc3b5aa765d61d8327deb882cf99
alice:5f4dcc3b5aa765d61d8327deb882cf99
```

If usernames are present, add `--username` to the command so hashcat ignores them:

```bash
hashcat -m 0 -a 0 --username hashes.txt wordlist.txt
```

### Creating a test MD5 hash

```bash
# On Linux
echo -n "password" | md5sum | cut -d' ' -f1 > hashes.txt

# On macOS
echo -n "password" | md5 > hashes.txt
```

### Showing already cracked passwords

Hashcat saves results to a **potfile** (`~/.hashcat/hashcat.potfile`).

```bash
hashcat -m 0 hashes.txt --show
```

<div style="background:#fce4ec; border-left: 4px solid #e53935; padding: 12px 16px; border-radius: 0 6px 6px 0; margin: 12px 0;">
  <strong>⚠️ Warning:</strong> Like John, hashcat will skip any hash it has already cracked in a previous session. To force a re-attack, use <code>--potfile-disable</code> to ignore the potfile, or delete the relevant entry from <code>~/.hashcat/hashcat.potfile</code>.
</div>

---

## 5. Attack modes — the `-a` flag

Every hashcat command also requires specifying the attack mode with `-a <number>`.

<table style="border-collapse: collapse; width: 100%; margin: 12px 0;">
  <thead>
    <tr style="background: #1a0a2e; color: white;">
      <th style="padding: 8px 14px; text-align: left;">-a</th>
      <th style="padding: 8px 14px; text-align: left;">Mode</th>
      <th style="padding: 8px 14px; text-align: left;">Description</th>
    </tr>
  </thead>
  <tbody>
    <tr style="background:#f5f5f5;"><td style="padding:7px 14px;"><code>0</code></td><td style="padding:7px 14px;">Straight</td><td style="padding:7px 14px;">Wordlist, optionally with rules</td></tr>
    <tr><td style="padding:7px 14px;"><code>1</code></td><td style="padding:7px 14px;">Combination</td><td style="padding:7px 14px;">Concatenates words from two wordlists</td></tr>
    <tr style="background:#f5f5f5;"><td style="padding:7px 14px;"><code>3</code></td><td style="padding:7px 14px;">Brute-force</td><td style="padding:7px 14px;">Pure mask-based exhaustive search</td></tr>
    <tr><td style="padding:7px 14px;"><code>6</code></td><td style="padding:7px 14px;">Hybrid Wordlist + Mask</td><td style="padding:7px 14px;">Word from list, mask appended</td></tr>
    <tr style="background:#f5f5f5;"><td style="padding:7px 14px;"><code>7</code></td><td style="padding:7px 14px;">Hybrid Mask + Wordlist</td><td style="padding:7px 14px;">Mask prepended, word from list</td></tr>
    <tr><td style="padding:7px 14px;"><code>9</code></td><td style="padding:7px 14px;">Association</td><td style="padding:7px 14px;">Uses metadata (username, email) to guide guesses</td></tr>
  </tbody>
</table>

---

## 6. Brute force (attack mode 3)

Mode `-a 3` tries every possible combination described by a **mask**.
Hashcat's mask syntax is identical to John's:

<table style="border-collapse: collapse; width: 100%; margin: 12px 0;">
  <thead>
    <tr style="background: #1a0a2e; color: white;">
      <th style="padding: 8px 14px; text-align: left;">Placeholder</th>
      <th style="padding: 8px 14px; text-align: left;">Character set</th>
    </tr>
  </thead>
  <tbody>
    <tr style="background:#f5f5f5;"><td style="padding:7px 14px;"><code>?l</code></td><td style="padding:7px 14px;">lowercase letters (a–z)</td></tr>
    <tr><td style="padding:7px 14px;"><code>?u</code></td><td style="padding:7px 14px;">uppercase letters (A–Z)</td></tr>
    <tr style="background:#f5f5f5;"><td style="padding:7px 14px;"><code>?d</code></td><td style="padding:7px 14px;">digits (0–9)</td></tr>
    <tr><td style="padding:7px 14px;"><code>?s</code></td><td style="padding:7px 14px;">symbols (<code> !"#$%&'()*+,-./:;<=>?@[\]^_{|}~</code>)</td></tr>
    <tr style="background:#f5f5f5;"><td style="padding:7px 14px;"><code>?a</code></td><td style="padding:7px 14px;">all printable characters (?l?u?d?s)</td></tr>
    <tr><td style="padding:7px 14px;"><code>?h</code></td><td style="padding:7px 14px;">hex lowercase (0–9, a–f)</td></tr>
    <tr style="background:#f5f5f5;"><td style="padding:7px 14px;"><code>?b</code></td><td style="padding:7px 14px;">full byte range (0x00–0xff)</td></tr>
  </tbody>
</table>

### Examples

Exactly 6 digits (e.g. a PIN):

```bash
hashcat -m 0 -a 3 hashes.txt ?d?d?d?d?d?d
```

8 characters, any printable character:

```bash
hashcat -m 0 -a 3 hashes.txt ?a?a?a?a?a?a?a?a
```

Pattern: uppercase + 5 lowercase + 2 digits (e.g. `Marco91`):

```bash
hashcat -m 0 -a 3 hashes.txt ?u?l?l?l?l?l?d?d
```

### Increment mode — variable length brute force

Instead of a fixed-length mask, `-i` tries all lengths up to the mask length:

```bash
# Try all lengths from 1 to 8 characters (digits only)
hashcat -m 0 -a 3 -i hashes.txt ?d?d?d?d?d?d?d?d

# Control the range explicitly
hashcat -m 0 -a 3 -i --increment-min=4 --increment-max=8 hashes.txt ?a?a?a?a?a?a?a?a
```

### Preview candidates without attacking

```bash
hashcat -a 3 --stdout ?u?l?l?l?d?d | head -20
```

<div style="background:#e3f2fd; border-left: 4px solid #1e88e5; padding: 12px 16px; border-radius: 0 6px 6px 0; margin: 12px 0;">
  <strong>🔍 Debug tip:</strong> <code>--stdout</code> works in hashcat exactly as in John — it prints candidates without attempting any crack. Use it to verify masks and rules before committing to a real attack.
</div>

---

## 7. Wordlist attack (attack mode 0)

Mode `-a 0` tries every word in a dictionary file, one per line.

```bash
hashcat -m 0 -a 0 hashes.txt wordlist.txt
```

Using the wordlist included in this course:

```bash
hashcat -m 0 -a 0 hashes.txt \
  ../../"Password generation"/Resources/wordlists/xato-net-10-million-passwords-10000.txt
```

Show results after the run:

```bash
hashcat -m 0 hashes.txt --show
```

<div style="background:#e8f5e9; border-left: 4px solid #43a047; padding: 12px 16px; border-radius: 0 6px 6px 0; margin: 12px 0;">
  <strong>📌 Why it works:</strong> The same reason as with John — most users pick predictable passwords. The GPU acceleration in hashcat means it can exhaust a 10,000-entry wordlist against MD5 in microseconds.
</div>

---

## 8. Wordlist + rules (attack mode 0 + `-r`)

Rules are the most powerful feature in hashcat. They apply transformations
to each word in the wordlist, generating variants on the fly.

```bash
hashcat -m 0 -a 0 hashes.txt wordlist.txt -r rules/best66.rule
```

### Available rule files

Rule files are stored in the hashcat installation directory:

```bash
ls /opt/homebrew/Cellar/hashcat/7.1.2/share/doc/hashcat/rules/
```

Notable rule files:

<table style="border-collapse: collapse; width: 100%; margin: 12px 0;">
  <thead>
    <tr style="background: #1a0a2e; color: white;">
      <th style="padding: 8px 14px; text-align: left;">Rule file</th>
      <th style="padding: 8px 14px; text-align: left;">Description</th>
    </tr>
  </thead>
  <tbody>
    <tr style="background:#f5f5f5;"><td style="padding:7px 14px;"><code>best66.rule</code></td><td style="padding:7px 14px;">66 high-yield transformations — the go-to starting point</td></tr>
    <tr><td style="padding:7px 14px;"><code>rockyou-30000.rule</code></td><td style="padding:7px 14px;">30,000 rules derived from RockYou password patterns</td></tr>
    <tr style="background:#f5f5f5;"><td style="padding:7px 14px;"><code>d3ad0ne.rule</code></td><td style="padding:7px 14px;">Aggressive set for deeper attacks</td></tr>
    <tr><td style="padding:7px 14px;"><code>dive.rule</code></td><td style="padding:7px 14px;">Very large ruleset, thorough but slow</td></tr>
    <tr style="background:#f5f5f5;"><td style="padding:7px 14px;"><code>leetspeak.rule</code></td><td style="padding:7px 14px;">Common character substitutions (a→@, e→3, o→0…)</td></tr>
    <tr><td style="padding:7px 14px;"><code>toggles1-5.rule</code></td><td style="padding:7px 14px;">Case toggles at various positions</td></tr>
    <tr style="background:#f5f5f5;"><td style="padding:7px 14px;"><code>top10_2025.rule</code></td><td style="padding:7px 14px;">Rules based on 2025 most common password patterns</td></tr>
  </tbody>
</table>

### Stacking multiple rule files

You can apply multiple rule files simultaneously:

```bash
hashcat -m 0 -a 0 hashes.txt wordlist.txt \
  -r rules/best66.rule \
  -r rules/leetspeak.rule
```

### Inline rules with `-j` and `-k`

For a single quick rule without creating a file, use `-j` (left word) or `-k` (right word in combination mode):

```bash
# Capitalize every word from the wordlist
hashcat -m 0 -a 0 hashes.txt wordlist.txt -j 'c'

# Append "1" to every word
hashcat -m 0 -a 0 hashes.txt wordlist.txt -j '$1'
```

### Preview what rules generate

```bash
hashcat -a 0 --stdout wordlist.txt -r rules/best66.rule | head -50
```

---

## 9. Custom rule

Hashcat rule files use the same operator syntax as John the Ripper.
Save your rules in a `.rule` file, one rule per line.

### Main rule operators

<table style="border-collapse: collapse; width: 100%; margin: 12px 0;">
  <thead>
    <tr style="background: #1a0a2e; color: white;">
      <th style="padding: 8px 14px; text-align: left;">Operator</th>
      <th style="padding: 8px 14px; text-align: left;">Effect</th>
      <th style="padding: 8px 14px; text-align: left;">Example (input: <code>password</code>)</th>
    </tr>
  </thead>
  <tbody>
    <tr style="background:#f5f5f5;"><td style="padding:7px 14px;"><code>:</code></td><td style="padding:7px 14px;">no-op, pass through as-is</td><td style="padding:7px 14px;"><code>password</code></td></tr>
    <tr><td style="padding:7px 14px;"><code>l</code></td><td style="padding:7px 14px;">all lowercase</td><td style="padding:7px 14px;"><code>password</code></td></tr>
    <tr style="background:#f5f5f5;"><td style="padding:7px 14px;"><code>u</code></td><td style="padding:7px 14px;">all uppercase</td><td style="padding:7px 14px;"><code>PASSWORD</code></td></tr>
    <tr><td style="padding:7px 14px;"><code>c</code></td><td style="padding:7px 14px;">capitalize first letter</td><td style="padding:7px 14px;"><code>Password</code></td></tr>
    <tr style="background:#f5f5f5;"><td style="padding:7px 14px;"><code>r</code></td><td style="padding:7px 14px;">reverse</td><td style="padding:7px 14px;"><code>drowssap</code></td></tr>
    <tr><td style="padding:7px 14px;"><code>d</code></td><td style="padding:7px 14px;">duplicate</td><td style="padding:7px 14px;"><code>passwordpassword</code></td></tr>
    <tr style="background:#f5f5f5;"><td style="padding:7px 14px;"><code>$X</code></td><td style="padding:7px 14px;">append character X</td><td style="padding:7px 14px;"><code>$1</code> → <code>password1</code></td></tr>
    <tr><td style="padding:7px 14px;"><code>^X</code></td><td style="padding:7px 14px;">prepend character X</td><td style="padding:7px 14px;"><code>^!</code> → <code>!password</code></td></tr>
    <tr style="background:#f5f5f5;"><td style="padding:7px 14px;"><code>sXY</code></td><td style="padding:7px 14px;">substitute X with Y</td><td style="padding:7px 14px;"><code>so0</code> → <code>passw0rd</code></td></tr>
    <tr><td style="padding:7px 14px;"><code>TN</code></td><td style="padding:7px 14px;">toggle case at position N</td><td style="padding:7px 14px;"><code>T0</code> → <code>Password</code></td></tr>
    <tr style="background:#f5f5f5;"><td style="padding:7px 14px;"><code>DN</code></td><td style="padding:7px 14px;">delete character at position N</td><td style="padding:7px 14px;"><code>D0</code> → <code>assword</code></td></tr>
    <tr><td style="padding:7px 14px;"><code>iNX</code></td><td style="padding:7px 14px;">insert X at position N</td><td style="padding:7px 14px;"><code>i0!</code> → <code>!password</code></td></tr>
  </tbody>
</table>

### Creating and using a custom rule file

```bash
# Create the rule file
cat > my_rules.rule << 'EOF'
# Pass through as-is
:
# Capitalize + append current year
c $2 $0 $2 $5
# Capitalize + common symbol + 2 digits
c $! $1 $2
c $@ $1 $2
# Leetspeak: a→@  e→3  o→0
sa@ se3 so0
# Leetspeak + capitalize
sa@ se3 so0 c
# Reverse + capitalize
r c
EOF

# Preview what it generates
hashcat -a 0 --stdout wordlist.txt -r my_rules.rule | head -30

# Use it in an attack
hashcat -m 0 -a 0 hashes.txt wordlist.txt -r my_rules.rule
```

### Rule debugging

Hashcat can show you exactly which rule matched which hash:

```bash
hashcat -m 0 -a 0 hashes.txt wordlist.txt \
  -r rules/best66.rule \
  --debug-mode=4 \
  --debug-file=debug.log

# The debug file shows: original_word:rule_applied:result
cat debug.log
```

---

## 10. Hybrid attacks (modes 6 and 7)

Hybrid modes combine a wordlist with a mask. This is equivalent to John's
`--mask=?w?d?d` approach but implemented as a dedicated attack mode.

### Mode 6 — Wordlist + Mask (append)

Each word from the list is combined with every possible mask suffix.
Generates patterns like `password123`, `password!`, `qwerty2025`.

```bash
# Word + 2 digits  (password → password00 … password99)
hashcat -m 0 -a 6 hashes.txt wordlist.txt ?d?d

# Word + symbol + 2 digits
hashcat -m 0 -a 6 hashes.txt wordlist.txt ?s?d?d
```

### Mode 7 — Mask + Wordlist (prepend)

The mask prefix is generated first, then each word is appended.
Generates patterns like `123password`, `!qwerty`.

```bash
# 2 digits + word
hashcat -m 0 -a 7 hashes.txt ?d?d wordlist.txt

# Symbol + word
hashcat -m 0 -a 7 hashes.txt ?s wordlist.txt
```

<div style="background:#e8f5e9; border-left: 4px solid #43a047; padding: 12px 16px; border-radius: 0 6px 6px 0; margin: 12px 0;">
  <strong>📌 When to use it:</strong> Hybrid attacks are ideal when you know the password follows a common pattern — a word with a number suffix, a year appended, or a special character prefix. They cover a much smaller search space than pure brute force while targeting the most likely candidates.
</div>

---

## 11. Combination attack (attack mode 1)

Mode `-a 1` concatenates every word from wordlist A with every word from wordlist B.
Useful for cracking passphrases or compound passwords.

```bash
# Generates: passwordpassword, passwordqwerty, qwertypassword, …
hashcat -m 0 -a 1 hashes.txt wordlist.txt wordlist.txt

# With rules applied to the left word
hashcat -m 0 -a 1 hashes.txt wordlist.txt wordlist.txt -j 'c'
```

---

## 12. Custom charsets

Hashcat allows you to define up to 8 custom charsets (`?1` through `?8`)
using the `-1` to `-8` flags. This gives fine-grained control over the
character pool used in mask attacks.

```bash
# Define ?1 as lowercase + digits, then use it in a mask
hashcat -m 0 -a 3 hashes.txt -1 ?l?d ?1?1?1?1?1?1

# Define ?1 as only vowels
hashcat -m 0 -a 3 hashes.txt -1 aeiou ?1?1?1?1

# Define ?1 as a specific set of symbols
hashcat -m 0 -a 3 hashes.txt -1 '!@#$' ?u?l?l?l?l?1?d?d
```

This is more efficient than `?a` when you know the character pool is limited,
as it reduces the search space without sacrificing coverage.

---

## 13. Benchmarking

The `-b` flag runs a speed benchmark across selected hash modes.

```bash
# Benchmark all supported hash modes
hashcat -b

# Benchmark specific modes
hashcat -b -m 0       # MD5
hashcat -b -m 1400    # SHA-256
hashcat -b -m 3200    # bcrypt
hashcat -b -m 1800    # sha512crypt
```

### Reading the output

```
Hashmode: 0 - MD5

Speed.#1.........: 2847.3 MH/s (28.12ms) @ Accel:1024 Loops:1024 Thr:32 Vec:1
```

- **MH/s** = millions of hashes per second
- **kH/s** = thousands of hashes per second (for slow algorithms)
- **Accel / Loops / Thr** = GPU tuning parameters (auto-set by hashcat)

### Indicative throughput comparison (Apple M-series GPU via Metal)

<table style="border-collapse: collapse; width: 100%; margin: 12px 0;">
  <thead>
    <tr style="background: #1a0a2e; color: white;">
      <th style="padding: 8px 14px; text-align: left;">Format</th>
      <th style="padding: 8px 14px; text-align: left;">Approx. speed</th>
      <th style="padding: 8px 14px; text-align: left;">Time to try 1M candidates</th>
    </tr>
  </thead>
  <tbody>
    <tr style="background:#f5f5f5;"><td style="padding:7px 14px;">MD5</td><td style="padding:7px 14px;">~2–3 billion/s</td><td style="padding:7px 14px; color:#e53935;"><strong>&lt; 1 ms</strong></td></tr>
    <tr><td style="padding:7px 14px;">SHA-256</td><td style="padding:7px 14px;">~1 billion/s</td><td style="padding:7px 14px; color:#e53935;"><strong>~1 ms</strong></td></tr>
    <tr style="background:#f5f5f5;"><td style="padding:7px 14px;">NTLM</td><td style="padding:7px 14px;">~5 billion/s</td><td style="padding:7px 14px; color:#e53935;"><strong>&lt; 1 ms</strong></td></tr>
    <tr><td style="padding:7px 14px;">bcrypt (cost 12)</td><td style="padding:7px 14px;">~10–20/s</td><td style="padding:7px 14px; color:#f9a825;"><strong>~14 hours</strong></td></tr>
    <tr style="background:#f5f5f5;"><td style="padding:7px 14px;">sha512crypt (<code>$6$</code>)</td><td style="padding:7px 14px;">~500k/s</td><td style="padding:7px 14px; color:#f9a825;"><strong>~2 seconds</strong></td></tr>
    <tr><td style="padding:7px 14px;">Argon2</td><td style="padding:7px 14px;">~5–20/s</td><td style="padding:7px 14px; color:#43a047;"><strong>Days</strong></td></tr>
  </tbody>
</table>

<div style="background:#e3f2fd; border-left: 4px solid #1e88e5; padding: 12px 16px; border-radius: 0 6px 6px 0; margin: 12px 0;">
  <strong>🔗 Connect the dots:</strong> Compare these GPU speeds with the CPU speeds from <code>john --test</code> in <code>JOHN.md</code>, and with the cracking time projections in <code>Password_Storage_Evolution.ipynb</code>. A GPU cluster with hundreds of cards multiplies these numbers proportionally — which is exactly why bcrypt and Argon2 were designed to remain slow even on specialised hardware.
</div>

---

## Quick reference

```bash
# ── Information ────────────────────────────────────────────────────────────
hashcat -h                                      # help
hashcat -hh                                     # help + all hash modes
hashcat -I                                      # backend/GPU info
hashcat -b -m 0                                 # benchmark MD5

# ── Hash identification ────────────────────────────────────────────────────
hashcat --identify hashes.txt                   # identify hash type

# ── Attack modes ───────────────────────────────────────────────────────────
hashcat -m 0 -a 0 hashes.txt wordlist.txt                    # wordlist
hashcat -m 0 -a 0 hashes.txt wordlist.txt -r rules/best66.rule  # + rules
hashcat -m 0 -a 3 hashes.txt ?u?l?l?l?d?d                   # brute force (mask)
hashcat -m 0 -a 3 -i hashes.txt ?a?a?a?a?a?a?a?a            # increment mode
hashcat -m 0 -a 6 hashes.txt wordlist.txt ?d?d               # hybrid: word + mask
hashcat -m 0 -a 7 hashes.txt ?d?d wordlist.txt               # hybrid: mask + word
hashcat -m 0 -a 1 hashes.txt wordlist.txt wordlist.txt       # combinator

# ── Custom charset ─────────────────────────────────────────────────────────
hashcat -m 0 -a 3 hashes.txt -1 ?l?d ?1?1?1?1?1?1           # custom charset

# ── Debug & results ────────────────────────────────────────────────────────
hashcat -a 0 --stdout wordlist.txt -r rules/best66.rule      # preview candidates
hashcat -m 0 hashes.txt --show                               # display cracked hashes
hashcat -m 0 -a 0 hashes.txt wordlist.txt --debug-mode=4 --debug-file=debug.log
```

---

## Resources

- Official website: [hashcat.net](https://hashcat.net)
- Wiki & tutorials: [hashcat.net/wiki](https://hashcat.net/wiki)
- Rule syntax reference: [hashcat.net/wiki/doku.php?id=rule_based_attack](https://hashcat.net/wiki/doku.php?id=rule_based_attack)
- Rule files location: `/opt/homebrew/Cellar/hashcat/7.1.2/share/doc/hashcat/rules/`
- Discord community: [hashcat.net/discord](https://hashcat.net/discord)
