10 most popular password cracking tools [updated 2025]

Passwords are the most commonly used method for user authentication. Passwords are so popular because their logic makes sense to people and are relatively easy for developers to implement. 

However, passwords can also introduce security vulnerabilities. Password crackers are designed to take credential data stolen in a data breach or other hack and extract passwords from it. 

2025 update: AI tools have altered the process of hacking forever. We made a free course to help you Learn how to hack and use AI.

View Free Course

What is password cracking? 

A well-designed password-based authentication system doesn’t store a user’s actual password. This would make it far too easy for a hacker or a malicious insider to gain access to all of the user accounts on the system. 

Instead, authentication systems store a password hash, which results from sending the password — and a random value called a salt — through a hash function. Hash functions are designed to be one-way, meaning that it’s very difficult to determine the input that produces a given output. Since hash functions are also deterministic (meaning that the same input produces the same output), comparing two password hashes (the stored one and the hash of the password provided by a user) is almost as good as comparing the real passwords. 

Password cracking refers to the process of extracting passwords from the associated password hash. This can be accomplished in a few different ways: 

• Dictionary attack: Most people use weak and common passwords. Taking a list of words and adding a few permutations — like substituting $ for s — enables a password cracker to learn a lot of passwords very quickly.
• Brute-force guessing attack: There are only so many potential passwords of a given length. While slow, a brute-force attack (trying all possible password combinations) guarantees that an attacker will crack the password eventually. 
• Hybrid attack: A hybrid attack mixes these two techniques. It starts by checking to see if a password can be cracked using a dictionary attack, then moves on to a brute-force attack if the initial method is unsuccessful. 

Most password-cracking or password-hacking tools enable a hacker to perform any of these types of attacks. This post describes some of the most commonly used hash-cracking tools. 

FREE role-guided training plans

Get 12 cybersecurity training plans — one for each of the most common roles requested by employers.

Download Now

Best password hacking tools 

1. Hashcat

Hashcat is one of the most popular and widely used password cracking software tools in existence. It is available on every operating system and supports over 300 different types of hashes. 

Hashcat enables highly parallelized password cracking which allows it to crack multiple different passwords on multiple different devices at the same time and support a distributed hash-cracking system via overlays. Cracking is optimized with integrated performance tuning and temperature monitoring. 

Download Hashcat here. 

2. John the Ripper 

John the Ripper is a well-known free password cracker that’s also open-sourced. It’s designed for Linux, Unix and Mac OS X. A Windows version is also available. 

John the Ripper offers password cracking for a variety of different password types. It goes beyond OS passwords to include common web apps (like WordPress), compressed archives, document files (Microsoft Office files, PDFs and so on) and more. 

A pro version of the tool is also available, which offers better features and native packages for target operating systems. You can also download Openwall GNU/*/Linux, which comes with John the Ripper. 

Download John the Ripper here. 

3. Wfuzz 

Wfuzz is a web application password-cracking tool that tries to crack passwords via a brute-force guessing attack. It can also be used to find hidden resources like directories, servlets and scripts. Wfuzz can also identify injection vulnerabilities within an application such as SQL injection, XSS injection and LDAP injection. 

Key features of the Wfuzz password-cracking tool include: 

• Injection at multiple points in multiple directories
• Output in colored HTML 
• Post, headers and authentication data brute-forcing 
• Proxy and SOCK support, multiple proxy support 
• Multi-threading 
• HTTP password brute-force via GET or POST requests 
• Time delay between requests 
• Cookie fuzzing 

You can download Wfuzz here. 

4. THC Hydra

THC Hydra is an online password-cracking tool that attempts to determine user credentials via a brute-force password-guessing attack. It is available for Windows, Linux, Free BSD, Solaris and OS X. 

THC Hydra is extensible with the ability to install new modules easily. It also supports several network protocols, including Asterisk, AFP, Cisco AAA, Cisco auth, Cisco enable, CVS, Firebird, FTP, HTTP-FORM-GET, HTTP-FORM-POST, HTTP-GET, HTTP-HEAD, HTTP-PROXY, HTTPS-FORM-GET, HTTPS-FORM-POST, HTTPS-GET, HTTPS-HEAD, HTTP-Proxy, ICQ, IMAP, IRC, LDAP, MS-SQL, MYSQL, NCP, NNTP, Oracle Listener, Oracle SID, Oracle, PC-Anywhere, PCNFS, POP3, POSTGRES, RDP, Rexec, Rlogin, Rsh, SAP/R3, SIP, SMB, SMTP, SMTP Enum, SNMP, SOCKS5, SSH (v1 and v2), Subversion, Teamspeak (TS2), Telnet, VMware-Auth, VNC and XMPP. 

Download the source code for THC Hydra here. 

If you are a developer, you can also contribute to the tool’s development. 

5. Medusa 

Medusa is an online password-cracking tool similar to THC Hydra. It claims to be a speedy parallel, modular and login brute-forcing tool. It supports HTTP, FTP, CVS, AFP, IMAP, MS SQL, MYSQL, NCP, NNTP, POP3, PostgreSQL, pcAnywhere, rlogin, SMB, rsh, SMTP, SNMP, SSH, SVN, VNC, VmAuthd and Telnet. 

Medusa is a command-line tool, so some level of command-line knowledge is necessary to use it. Password-cracking speed depends on speed of network connectivity. On a local system, it can test 2,000 passwords per minute. 

Medusa also supports parallelized attacks. In addition to a word list of passwords to try, it is also possible to define a list of usernames or email addresses to test during an attack. 

Read more about Medusa 

Download Medusa 

FREE role-guided training plans

Get 12 cybersecurity training plans — one for each of the most common roles requested by employers.

Download Now

6. RainbowCrack

All password-cracking is subject to a time-memory tradeoff. If an attacker has precomputed a table of password/hash pairs and stored them as a “rainbow table,” then the password-cracking process is simplified to a table lookup. This threat is why passwords are now salted: adding a unique, random value to every password before hashing it means that the number of rainbow tables required is much larger. 

RainbowCrack is a password-cracking tool designed to work using rainbow tables. It is possible to generate custom rainbow tables or take advantage of preexisting ones downloaded online. RainbowCrack offers free downloads of rainbow tables for the LANMAN, NTLM, MD5 and SHA1 password systems. 

Download rainbow tables here. 

This tool is available for both Windows and Linux systems. 

Download RainbowCrack here. 

7. OphCrack

OphCrack is a free rainbow table-based password-cracking tool for Windows. It is the most popular Windows password-cracking tool but can also be used on Linux and Mac systems. It cracks LM and NTLM hashes. Free rainbow tables are also available for cracking Windows XP, Vista and Windows 7. 

A live CD of OphCrack is also available to simplify the cracking. One can use the live CD of OphCrack to crack Windows-based passwords. This tool is available for free. 

Download OphCrack here. 

Download free and premium rainbow tables for OphCrack here. 

8. L0phtCrack

L0phtCrack is an alternative to OphCrack. It attempts to crack Windows passwords from hashes. For cracking passwords, it uses Windows workstations, network servers, primary domain controllers and Active Directory. It also uses dictionary and brute-force attacks to generate and guess passwords. It was acquired by Symantec and discontinued in 2006. Later, L0pht developers again reacquired it and launched L0phtCrack in 2009. 

L0phtCrack also comes with the ability to scan routine password security scans. One can set daily, weekly or monthly audits, and it will start scanning at the scheduled time. In 2021, L0phtCrack was re-released as an open-source program. 

Learn more about L0phtCrack 

9. Aircrack-ng

Aircrack-ng is a Wi-Fi password-cracking tool that can crack WEP or WPA/WPA2 PSK passwords. (An excellent introduction to WPA/WPA2 password hacking by Mike Myers is also available.) It analyzes wireless encrypted packets and then tries to crack passwords via dictionary attacks and the PTW, FMS and other cracking algorithms. It is available for Linux and Windows systems. A live CD of Aircrack is also available. 

Aircrack-ng tutorials are available for download. 

Download Aircrack-ng 

10. Brutus

Brutus was one of the most popular remote online password-cracking tools. It claims to be the fastest and most flexible password-cracking tool. This tool is free and is only available for Windows systems. It was first released back in October 2000.  

Brutus supports many authentication types, including: 

• HTTP (basic authentication)
• HTTP (HTML Form/CGI)
• POP3
• FTP
• SMB
• Telnet
• IMAP
• NNTP
• NetBus
• Custom protocols 

It can also support multi-stage authentication protocols and attack up to sixty targets in parallel. It also offers the ability to pause, resume and import an attack. 

Brutus has not been updated for several years. However, its support for various authentication protocols and its ability to add custom modules make it a popular tool for online password-cracking attacks. 

Get the Brutus password finder. 

[Skill-building tip: Infosec’s article, How to crack a password, provides a walkthrough of some basic cracking methods and provides techniques you can try with the password crackers discussed here.] 

How to create a password that’s hard to crack

In this post, we have listed the 10 best password crackers. These tools try to crack passwords with different password-cracking algorithms. Most of the password-hacking software online is available for free. So, you should always try to have a strong password that is hard to crack. These are a few tips you can try while creating a password. 

• The longer the password, the harder it is to crack: Password length remains one of the most important factors. The complexity of a brute force password guessing attack grows exponentially with the length of the password. A random seven-character password can be cracked in minutes, while a similarly random ten-character password can take hundreds of years.
• Always use a combination of characters, numbers, and special characters: Using a variety of characters also makes brute-force password-guessing more difficult since crackers need to try a wider variety of options for each character of the password. Incorporate numbers and special characters, and not just at the end of the password or as a letter substitution (like @ for a).
• Variety in passwords: Credential stuffing attacks use bots to test if passwords stolen from one online account are also used for other accounts. A data breach at a tiny company could compromise a bank account if the same credentials are used. Use a long, random, unique password for all online accounts. 

What to avoid while selecting your password 

Cybercriminals and password cracker developers know all the “clever” tricks people use to create their passwords. A few common password mistakes that should be avoided include: 

1. Using a dictionary word: Dictionary attacks are designed to test every word in the dictionary (and common permutations) in seconds.
2. Using personal information: A pet’s name, relative’s name, birthplace, favorite sport and so on are all dictionary words. Even if they weren’t, tools exist to grab this information from social media and build a wordlist from it for an attack. And don’t ever partake in social media “quizzes” that ask you to post this type of information publicly!
3. Using patterns: Passwords like 1111111, 12345678, qwerty and asdfgh are some of the most commonly used in existence. They’re also included in every password cracker’s wordlist.
4. Using character substitutions: Character substitutions like 4 for A and $ for S are well-known. Dictionary attacks test for these substitutions automatically. They can be part of a more complex password-creating process but should not be considered sufficient on their own.
5. Using numbers and special characters only at the end: Most people put their required numbers and special characters at the end of the password. These patterns are built into password crackers.
6. Using common passwords: Every year, companies like Splashdata publish lists of the most commonly used passwords. They create these lists by cracking breached passwords, just like an attacker would. Never use the passwords on these lists or anything like them.
7. Using anything but a random password: Ultimately, Passwords should be long, random and unique. Using a password manager to generate and store passwords for online accounts remains a security best practice.

Get your guide to the top-paying certifications

With more than 448,000 U.S. cybersecurity job openings annually, get answers to all your cybersecurity salary questions with our free ebook!

Get Your Copy

Conclusion 

Password-cracking tools are designed to take the password hashes leaked during a data breach or stolen using an attack and extract the original passwords from them. They accomplish this by taking advantage of the use of weak passwords or by trying every potential password of a given length. 

Password finders can be used for various purposes, not all of them bad. While cybercriminals commonly use them, security teams can also use them to audit the strength of their users’ passwords and assess the risk of weak passwords to the organization. 

Learning to crack passwords with these common tools is a great way to demonstrate your hands-on experience with security concepts. You can learn more about how to start a cybersecurity career even if you have no experience.