Hashcat — Install, Use, Optimise (2026)

GPU-accelerated password cracker — the world's fastest, supports 350+ hash modes including NTLM, Kerberos, bcrypt, KeePass.

Installation

Pick the install method that matches your stack. The Docker option is the cleanest for one-off scans where you don’t want to pollute your workstation.

Linux (apt)

sudo apt install hashcat

macOS (brew)

brew install hashcat

Windows

Download zip from hashcat.net, run hashcat.exe directly

Core commands

The handful of invocations you’ll actually run on 90% of engagements:

NTLM hash + dictionary

hashcat -m 1000 hashes.txt rockyou.txt

NTLM + rule (best for human pwds)

hashcat -m 1000 hashes.txt rockyou.txt -r rules/best64.rule

Pure brute force (8 char alphanumeric)

hashcat -m 1000 hashes.txt -a 3 ?u?l?l?l?l?l?d?d

Mask attack (Spring2024!) pattern

hashcat -m 1000 hashes.txt -a 3 ?u?l?l?l?l?l2024?s

Kerberos AS-REP roast

hashcat -m 18200 asrep.txt rockyou.txt -r best64.rule

Kerberoast TGS

hashcat -m 13100 tgs.txt rockyou.txt -r best64.rule

WPA handshake

hashcat -m 22000 capture.hc22000 wordlist.txt

Performance optimisation

What separates a junior who runs the default invocation from a practitioner who knows the knobs:

• GPU is mandatory. RTX 4090 does ~250 GH/s NTLM, ~100 GH/s SHA-256, ~6 KH/s bcrypt.
• -O (optimized kernel) — 2-3× faster but limits password length to ~32 chars.
• -w 4 workload profile (1=desktop, 4=dedicated) — let it cook on dedicated rigs.
• --session=campaign + --restore survive crashes / reboots without re-cracking.
• -d 1,2,3 select GPUs explicitly when running multi-GPU.
• For NTLM dumps: rules in this order — best64 first, then OneRuleToRuleThemAll, then dive. Diminishing returns.
• Cloud GPU: AWS g5.4xlarge ($1.21/hr) gives one A10G — fine for short engagements. RunPod / vast.ai often cheaper for sustained.

Common pitfalls

Real failure modes that bite people on engagements. Most are recoverable; a few are reputation-damaging.

• CPU-mode is 100-1000× slower than GPU. Don’t bother on a laptop without dGPU.
• -O truncates to 27-32 char passwords depending on hash mode — long passphrases get missed silently.
• Hash format mistakes: NTLM is aad3b435b51404eeaad3b435b51404ee:HASH for the LMNT pair. -m 1000 wants only the NT half.
• Rules can blow up wordlist size 1000×. -r combined.rule of multiple rules = exponential.
• Thermal throttling: 90°C+ GPU temps slow it 30-50%. Air-cooling matters.

Modern alternatives in 2026

The ecosystem moves fast. These are tools you should at least be aware of:

• John the Ripper (Jumbo) — wider hash format support, slower.
• L0phtCrack — Windows-specific, GUI.

India context and engagement notes

For Indian engagements: most user passwords still match patterns like FirstName@123, Company2024!, Mumbai@123. Build custom masks reflecting Indian context (city names, company shortcodes, sport mascots) — 3-5× hit rate over generic rockyou.

⚖️ Legal: Use only on systems you own or have explicit written authorisation to test. In India, unauthorised access is punishable under Section 66 of the IT Act, 2000 (up to 3 years imprisonment + fine). Pair every engagement with a signed Statement of Work or Rules of Engagement before running anything from this page.