PAGES
← all tools
◆ Password & Credential Cracking

bruteforce-salted-openssl

1.5.0 open-source

bruteforce-salted-openssl tries to find the password of a file encrypted with the openssl command, using exhaustive or dictionary mode.

source ↗ rss ↗ What is a cyber toolchain? last repo push Apr 30, 2024

Summary

bruteforce-salted-openssl is an open-source command-line tool, free to use, that recovers the password on a file encrypted with OpenSSL's salted format by trying candidate passwords from a wordlist or a generated range against it, using PBKDF2 or the older key-derivation options and reporting speed and last-tried password as it goes. It is run directly from a terminal, with state that can be saved and restored across runs, which suits penetration testers and forensic examiners who have an encrypted blob and need to check it against weak or known-partial passwords rather than reversing the cipher itself. It sits in the password-cracking category alongside other offline brute-forcers, built specifically for OpenSSL's salted output rather than for general-purpose hash cracking. Development has been steady over a decade, from 2014 through a 2024 release adding PBKDF2 and SHA256SHA256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. defaults, though there have been no commits in the past year.

bruteforce-salted-openssl tries to find the password of a file encrypted with the openssl command, using exhaustive or dictionary mode.

How bruteforce-salted-openssl helps

What is the actual password protecting this OpenSSL-encrypted file?

tries every candidate from a supplied wordlist or a generated character range against the file's key derivation, reporting the last-tried password and success once a decryption yields valid output

Is this weak or partially-known password actually the one used on this evidence file?

lets the examiner restrict the search to a known prefix, suffix, or character set so a partial memory of the password can be confirmed or ruled out quickly rather than searching blind

How far did an earlier cracking attempt get before it was interrupted?

saves its search state to a file and resumes from that point on a later run, so a stopped session does not have to restart from the beginning

How fast is this attempt progressing, and is it worth letting it keep running?

reports bruteforcing speed and the most recently tried password at regular intervals, or on demand, so the operator can judge whether to keep going or change approach

Was this file encrypted with an older OpenSSL key-derivation scheme or the newer PBKDF2 one?

supports both the legacy hash-based derivation and PBKDF2 with configurable iteration count, letting the same tool be pointed at either kind of salted output

Does a candidate password produce a genuinely valid decryption or just one that looks plausible?

offers a preview of the decrypted output and an optional magic-bytes/string check, so a hit can be checked against expected file content rather than trusted blindly

all 4 features, with the evidence for each →

Languages

Not documented

Features

4 capabilities

Built from bruteforce-salted-openssl's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

What bruteforce-salted-openssl offers you

  • Command-line interface2
All capabilities 4 capabilities
Salted OpenSSL brute-force decryption shipped Attempts to recover the passphrase of files encrypted with OpenSSL's salted format by trying candidate passwords, including matching against the file's magic bytes. 1 release · 5 other sources · first seen Jun 2016

release

docs

  • ========================= - try all the possible passwords given a charset - try all the passwords in a file ## Exhaustive mode - the minimum password length to try - the maximum password length to try - the beginning of the password - the end of the password - the character set to use (among the characters of the… seen Sep 2026 · source
  • glv2 / bruteforce-salted-openssl Public Notifications You must be signed in to change notification settings Fork 53 Star 237 Conversation crazicrafter1 commented Apr 30, 2024 Copy link Copy Markdown Magic using regex This pull changes how matching is normally performed against the starting magic bytes. docs update · Aug 2026 · source
  • glv2 / bruteforce-salted-openssl Public Notifications You must be signed in to change notification settings Fork 53 Star 237 1.4.1 glv2 released this 21 Oct 16:23 1.4.1 This tag was signed with the committer’s verified signature . glv2 GPG key ID: 8F3F861F82EB7A9A Verified Learn about vigilant mode . docs update · Jul 2026 · source

example

  • Enable debug output to troubleshoot PBKDF2 attempts bruteforce-salted-openssl -D <other_options> 1.5.0 · Mar 2024 · source
  • Brute-force a PBKDF2-salted openssl key using the new options bruteforce-salted-openssl -K -i <iterations> <salt> <password_list> 1.5.0 · Mar 2024 · source
Debug Output Option shipped Provides a command-line flag to enable verbose debug logging for troubleshooting PBKDF2 attempts. 1 release · first seen Mar 2024

Also counts toward: Command-line interface

release

Default Hash Algorithm Update shipped Changes the underlying cryptographic hash function used for password derivation from MD5 to SHA256. 1 release · first seen Mar 2024

release

PBKDF2 Password Recovery Support shipped Enables brute-force decryption of files encrypted with OpenSSL using PBKDF2 key derivation by adding specific command-line options. 1 release · first seen Mar 2024

Also counts toward: Command-line interface

release

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for bruteforce-salted-openssl, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail bruteforce-salted-openssl puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

Show

5 entries

  1. August 20261
  3. July 20262
  5. March 20241
  7. June 20161
    Show

    5 entries

    1. docs update Aug 9, 2026 · issue 040

      bruteforce-salted-openssl adds regex support for the -M magic-bytes matcher, enabling binary file-type matching

      └──▷ TRY IT
      Crack a password for an OpenSSL-encrypted file of unknown binary type by matching multiple common file-magic signatures with a regex passed to -M.
      $ bruteforce-salted-openssl -1 -b supersecre -c aes-256-cbc -d md5 -m 11 -M ^\(%PDF\|"$(echo -e "\x89")"PNG\|"$(echo -e "\xFF\xD8\xFF")"\|"$(echo -e "\xFF\xFB\xFF\xF3\xFF\xF2")"\|ftyp\) -s rstuv -v 1 unknown_media.aes
      • The -M flag now accepts POSIXPOSIXA family of standards for operating-system interfaces, including process, file and shell behavior. Software that uses these interfaces is easier to move between compatible systems. extended regex patterns in addition to exact strings, allowing magic-byte matching against binary file formats (PNG, JPEG, MP3, MP4, PDF, etc.) whose headers contain non-printable bytes that previously defeated the strncmp-based check.

      1 detail in Everything

    2. docs update Jul 24, 2026 · issue 024

      bruteforce-salted-openssl 1.4.1 adds an option to ignore the salt during brute-force attacks.

      • Adds an option to ignore the salt when brute-forcing OpenSSL-encrypted files.

      1 detail in Everything

    3. docs update Jul 24, 2026 · docs issue 004

      bruteforce-salted-openssl 1.4.1 adds an option to ignore the salt during brute-force attacks.

      • Adds an option to ignore the salt when brute-forcing OpenSSL-encrypted files.

      1 detail in Everything

    4. 1.5.0 Mar 1, 2024 · release notes

      Add -K/-i for PBKDF2 and -D debug; switch default hash to SHA256SHA256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data.

      └──▷ GET THIS VERSION 
      $ git clone --branch 1.5.0 https://github.com/glv2/bruteforce-salted-openssl.git
# already have the repo? check out this version:
$ git checkout 1.5.0
      └──▷ TRY IT
      Brute-force a PBKDF2-salted openssl key using the new options
      $ bruteforce-salted-openssl -K -i <iterations> <salt> <password_list>
      Enable debug output to troubleshoot PBKDF2 attempts
      $ bruteforce-salted-openssl -D <other_options>
      • Adds -K and -i options for PBKDF2 support
      • Adds -D debug option

      2 details in Everything

      └──▷ BREAKING ON UPGRADE
      • !Default hash function changes from MD5 to SHA256
    5. 1.3.0 Jun 6, 2016 · release notes

      Adds password-file input, current-locale character support, and progress reporting when the process receives USR1.

      └──▷ GET THIS VERSION 
      $ git clone --branch 1.3.0 https://github.com/glv2/bruteforce-salted-openssl.git
# already have the repo? check out this version:
$ git checkout 1.3.0
      • Adds the ability to read passwords from a file.

      1 detail in Everything

    Project health

    Issue, contributor and maintainer activity in glv2/bruteforce-salted-openssl, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

    1. Contributors 0 ±0 vs prior 12 months
    2. Maintainers 0 +0 joined · −0 left, last 12 months
    3. Bus factor 0 committers behind half the commits
    4. Community-filed 100% of issues opened, last 12 months
    5. Median time to close < 1 day first maintainer reply 11 hours
    6. Open backlog 5 of 26 issues ever filed
    1. Issues opened / month 0 · 0 communitymaintainers
    2. Open backlog 5
    3. Contributors / month 0
    4. Commits / month 0
    5. Stars 236
    Issue themes, last 12 months
    • other 100%

    Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

    Libraries its release ships

    What its latest release locks, checked against known advisories.

    None of its release's images build from a lockfile we can read.

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    compare.md

      Free the public facts, no sign-in Any paid plan all other sections Researcher & Business pricing history and category rank

      my-toolchain — 0 tools

        Betas, release candidates and previews. Turn it off to see final releases only. It also applies to changes you ask for over MCP when you're signed in.
        browse all tools → score card for your toolchain →
        cyber-toolchain / feedback

        Send us feedback