Hashcat explained: hash modes, attack modes and how to defend passwords

Key takeaways

• Hashcat tests guesses against hashes. It does not reverse them.
• The -m option selects the hash type and -a selects the attack method.
• Fast hashes such as MD5 and NTLM fall quickly; slow hashes such as bcrypt and Argon2 resist.
• Audit only hashes you are authorised to test, as part of a scoped engagement.
• Defence: unique salts, slow hashing, long passphrases and MFA.

What is Hashcat?

Hashcat is a free, open-source tool that recovers passwords from their hashes by trying many guesses very quickly. It is documented at hashcat.net. It can use GPUs, which makes it fast on hash types designed to be fast.

A hash is a one-way fingerprint of a password. Hashcat does not reverse it. It hashes each guess and compares the result with the stored hash.

Legal note. Cracking hashes you are not authorised to test is a crime under India's IT Act. Legitimate uses are authorised password audits, penetration tests, recovering your own data and learning in a lab with hashes you created.

How do you tell Hashcat what to do?

The general shape of a command is:

hashcat -m <hash mode> -a <attack mode> <hash file> <wordlist or mask>

• -m tells it which hash type the file contains.
• -a tells it how to generate guesses.
• --show prints passwords it has already recovered from its potfile.
• --help lists all modes. The mode numbers are in the built-in help and the Hashcat wiki.

Which hash modes matter in practice?

Identify the hash type before you start. Picking the wrong mode wastes time and returns nothing.

What attack modes does Hashcat offer?

• Dictionary (straight): tries each word in a list, optionally with rules that change case or add digits.
• Mask: tries guesses that fit a pattern, such as a word followed by four digits.
• Combinator and hybrid: join words together, or a word and a mask.
• Rules: transform each word, which is far more efficient than blind guessing.

The key point for defenders is that people choose predictable passwords, so wordlists with rules succeed more often than pure brute force.

Why does hashing choice matter so much?

Speed decides the outcome. A fast hash like MD5 lets a GPU test enormous numbers of guesses per second. A deliberately slow algorithm such as bcrypt or Argon2 cuts that number dramatically, and a unique salt per user stops the same guess from being tested against every account at once. The OWASP Password Storage Cheat Sheet describes current recommendations for storing passwords. Check it for the algorithm and settings it currently advises.

How is an authorised audit done?

1. Get written permission and agree scope.
2. Obtain hashes through a legitimate route, for example a test copy of a directory database.
3. Identify the hash type and run a time-limited audit with a good wordlist and rules.
4. Report the percentage and categories of weak passwords, such as reused or based on company names. Avoid listing passwords against named people where you can.
5. Recommend fixes: stronger hashing, a banned-password list, longer minimums and MFA.
6. Delete the hashes and results securely when the engagement ends.

What should you build for a lab?

Create your own test accounts in a VM, set passwords of varying strength, extract the hashes you generated, and see which ones fall to a small wordlist. Record the time taken for each. That teaches the lesson without touching anyone else's data.

What are the hardware needs?

A modern GPU makes a large difference for fast hashes. A CPU works for learning. Drivers matter, and installation problems usually come from missing GPU drivers or OpenCL runtime. Check the Hashcat documentation for your hardware.

How do you defend against it?

• Hash with bcrypt, scrypt or Argon2, and a unique salt per password.
• Require long passphrases and block common and breached passwords.
• Add multi-factor authentication so a cracked password is not enough.
• Protect hash databases like secrets, and monitor for exfiltration.

For related tools read John the Ripper and password cracking tools for ethical hackers.

Next steps

To practise password security in a legal lab, see our CEH v13 AI course or the VAPT course. Compare tools in Hydra, the network login tester.

Related reading

• What Are the Different Types of Password Cracking Methods and How Do They Work in Ethical Hacking?