PAGES
← all tools
◆ Password & Credential Cracking

hashcat-utils

v1.10 open-source

Small utilities that are useful in advanced password cracking - hashcat/hashcat-utils

Summary

hashcat-utils is an open-source, MIT-licensed set of small command-line utilities for password cracking, distributed as standalone binaries you build with gcc or clang or fetch pre-built for Linux and Windows. Each utility does one narrow job, such as generating n-grams from a wordlist, converting NTLMv1NTLMv1A Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. hashes into formats hashcat accepts, or combining wordlists, and because they all read STDIN and write STDOUT they chain together into pipelines rather than working as a single program. This suits people already running hashcat who need to prepare or transform candidate passwords and hash formats, not newcomers looking for an all-in-one cracker. Started in 2015 and still maintained by 23 contributors, with 24 commits in the past year and a release 342 days ago, the project is active though updates arrive slowly.

Small utilities that are useful in advanced password cracking - hashcat/hashcat-utils

How hashcat-utils helps

Which patterns in my cracked passwords could turn into a smarter wordlist for the next run?

breaks a wordlist or potfile down into overlapping character sequences so the frequent fragments in real passwords can be reused as candidates

Can I turn two separate wordlists into every plausible combined password without writing them out as one giant file first?

streams one list in from standard input and pairs it against a second file, emitting the concatenations directly so nothing touches disk as an intermediate

Is a captured NTLMv1 or MSCHAPv2 exchange actually usable in a cracking run?

converts the raw challenge/response line into the DES keys and hash formats hashcat accepts, so a Responder capture becomes crackable candidates instead of a dead end

Did a wordlist-generation change quietly shrink the candidates I can generate?

tracks the maximum password length combinators will build up to, so raising or lowering that ceiling shows up as fewer or more candidates coming out the far end

What did a past cracking session already recover, and can I reuse it instead of starting over?

reads a potfile and exports the plaintext-hash pairs it contains, turning session history into a list of already-known answers

all 20 features, with the evidence for each →

Languages

Not documented

Features

20 capabilities · 4 backed by code, an API document or a real run

Built from hashcat-utils's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

What hashcat-utils offers you

  • Command-line interface8
  • Python scripting support2
  • Scripting language support1
All capabilities 20 capabilities
Auxiliary hash-cracking utilities shipped Ships a set of small companion utilities (hashcat-utils) that support advanced workflows such as wordlist splitting and stdout-based pipelines. 14 releases · 5 other sources · first seen Feb 2017

Also counts toward: Command-line interface

release 14 total

  • Updates combinatorX to version 1.2. v1.10 · Sep 2025 · source · release history
  • Adds stdin support for combinatorX to read the first file from standard input, enabling pipeline-based workflows. v1.10 · Sep 2025 · source · release history
  • Adds --skip-zero-essid logic to skip processing when ESSID length is 0 or first BSSID byte is zero-byte (hidden networks) v1.7 · Feb 2017 · source · release history
  • Updates the output format version for cap2hccapx to version 4 v1.7 · Feb 2017 · source · release history
  • Adds deskey_to_ntlm.pl script for DES key to NTLM conversion. v1.4 · Feb 2017 · source · release history
  • Adds cap2hccapx utility to convert capture files to hccapx format. v1.4 · Feb 2017 · source · release history

docs

  • hashcat-utils is a set of small utilities for advanced password cracking. Each utility is provided as a separate stand-alone binary. Each utility performs one specific function. seen Oct 2026 · source
  • hashcat-utils are a set of small utilities that are useful in advanced password cracking. Each output file is 32.1 MB --stdout NOTE: splitlen does not append, it overwrites the files in the outdir. that's why you should use empty directories. seen Oct 2026 · source
  • that's it for initializing. However the generation of the cracked.out file is necessary because the autocrack Script waits for its existence. The command will work on all dictionaries. seen Oct 2026 · source
  • Collection of small standalone utilities for advanced password cracking, designed to work with STDIN/STDOUT for chaining.

example

  • Pipe a wordlist directly into combinatorX as the first file, combining it with a second wordlist without writing a temp file. cat wordlist1.txt | combinatorX - wordlist2.txt v1.10 · Sep 2025 · source
WPA/WPA2 hash capture processing shipped Accepts WPA/WPA2 captures in hccap and hccapx formats as well as the current mode-22000 format produced by hcxdumptool and hcxtools. 8 releases · 4 other sources · first seen Feb 2017

release 8 total

  • Adds CI/CD pipeline via GitHub Actions with downloadable build artifacts. v1.10 · Sep 2025 · source · release history
  • Add support for extracting essid from assoc and reassoc requests in cap2hccapx.c v1.8 · May 2017 · source · release history
  • cap2hccapx output format is now version 4; older parsers expecting version 3 may fail. v1.7 · Feb 2017 · source · release history
  • Enables reading truncated .cap files that are cut short in the middle of a packet v1.7 · Feb 2017 · source · release history
  • Extends cap2hccapx.c to allow Message-Pair values 1+2, 1+4, 2+3, and 3+4 v1.7 · Feb 2017 · source · release history
  • cap2hccapx updates output format to version 4 1.7 · Feb 2017 · source · release history

docs

  • hashcat has supported mode 22000 since version 6.0. For the capture and conversion commands below, use current, compatible versions of hcxdumptool and hcxtools: hcxdumptool: hcxpcapngtool, from hcxtools: hashcat: tshark -r dumpfile.cap -Y "(wlan.fc.type_subtype == 0x00 || wlan.fc.type_subtype == 0x02 ||… seen Oct 2026 · source
  • hccapx is an outdated custom format developed specifically for The hccapx format is an improved version of the old format. Both were designed for hash mode -m 2500 (WPA/WPA2). A valid hashcat binary file (with the .hccapx extension) contains one or more instances of the structure documented below. seen Oct 2026 · source
  • HCCAP is a custom format developed specifically for The data is the same as in the usual tcpdump format, but arranged differently. A valid hashcat capture file (with the .hccap extension) contains one or more instances of the structure documented below. seen Oct 2026 · source

example

  • Convert a Wi-Fi capture file to the HCCX format for use with hashcat. ./cap2hccapx input.cap output.hccx v1.3 · Feb 2017 · source
Dictionary and wordlist-based cracking documented Supports dictionary attacks using one or more wordlist files, including paired left/right file modes and per-line hash-to-word alignment. 5 other sources

Also counts toward: Command-line interface

docs

  • hashcat sometimes refers to the first dictionary specified on the command line as the left file, and the second dictionary as the right file. seen Oct 2026 · source
  • hashcat tests the third wordlist entry against the third hash entry. The files must have the same number of lines or hashcat refuses to start the attack. seen Oct 2026 · source
  • That advice dates from when the GPU tools were separate programs. Current reads wordlists directly. Use -a 0 for a dictionary attack. seen Oct 2026 · source
  • hashcat advanced password recovery hashcat Forums Wiki Tools Events Converter Table of Contents Generic Attack Description Running it Feeds that ship with hashcat When it is the right choice Writing your own Applies to master. seen Sep 2026 · source
  • hashcat advanced password recovery hashcat Forums Wiki Tools Events Converter Table of Contents PCFG Attack Description Why you would use it Running it What a ruleset looks like Using more than one ruleset Training your own ruleset Training a ruleset for another language 1. Get a corpus 2. seen Sep 2026 · source
Modular build system shipped Supports building individual binaries independently via Makefile targets, facilitating custom builds. 3 releases · 1 other source · first seen Feb 2017

release

  • Adds Makefile support for building individual binaries. v1.10 · Sep 2025 · source · release history
  • New release makefile target moves binaries from src to bin folder. v1.4 · Feb 2017 · source · release history
  • Adds release Makefile target to automatically move binaries from src to bin v1.3 · Feb 2017 · source · release history

example

  • Build the release binaries using the new Makefile target. make release v1.3 · Feb 2017 · source
Markov-chain ordered candidate generation shipped Orders candidate generation using Markov statistics so that more probable passwords are tested first, improving results when attacks are stopped early. 1 release · 3 other sources · first seen Aug 2018

Also counts toward: Command-line interface

release

  • Adds hcstat2gen.c (compiled as hcstat2gen) which generates statistics files supporting maximum password lengths up to 256 characters and includes a header in the output. v1.9 · Aug 2018 · source · release history

docs

  • -1, --custom-charset1=CS User-definable charsets There is no known alternative that can handle markov like this, but the following programs can at least generate wordlists and are partially configurable: John the Ripper (using --stdout ) seen Oct 2026 · source
  • The Markov-ordered run starts with . The statistics file determines this order. With the same full keyspace, both runs test the same 1,000 candidates, but Markov ordering tries more likely candidates first. This helps when you stop the attack before it finishes. seen Oct 2026 · source
  • Converter Table of Contents Markov attack Description You can see it Where the statistics come from Per position, or not Cutting the tail off Generating your own table See also Markov attack Description Markov is not really an attack of its own. seen Sep 2026 · source
Mask and brute-force attacks shipped Supports mask-based attacks that define per-position character sets to constrain or fully describe a keyspace, with user-definable custom charsets. 1 release · 3 other sources · first seen Aug 2018

Also counts toward: Command-line interface

release

  • Increases hcstatgen maximum password length from 64 to 256. v1.9 · Aug 2018 · source · release history

docs

  • High-Performance word generator with a per-position configurable charset -1, --custom-charset1=CS User-definable charsets John the Ripper (using --stdout ) seen Oct 2026 · source
  • hashcat charset files hashcat mask files Using a mask with a trained grammar There is no inherent disadvantage: a mask can describe the same keyspace as an unrestricted brute-force attack, or a smaller one when you have useful information about the password. seen Oct 2026 · source
  • hashcat advanced password recovery hashcat Forums Wiki Tools Events Converter Calculating total combinations for masks The very simplified per-position formula to calculate the total amount of combinations in a mask or password range looks like this: S = C n , where S is the total amount of combinations, C is the… seen Sep 2026 · source
Experimental attack modes (master branch) documented Provides additional attack modes — including mode 4, 5, 8, and 12 — available in the master branch but not in the current stable release. 4 other sources

docs

  • Attack mode 8 is in hashcat's master branch and is not in the 7.1.2 release, which prints seen Oct 2026 · source
  • Attack mode 12: place a word within a mask - you write a mask and mark inside it where the word goes Attack mode 12: place a word within a mask Attack mode 12 is in hashcat's master branch and is not in the 7.1.2 release, which prints below are in the release and need no extra build. seen Oct 2026 · source
  • Attack mode 5 is in hashcat's master branch and is not in the 7.1.2 release, which prints --restore seen Oct 2026 · source
  • Holding it to a shape A literal is not a filter on the output Attack mode 4 is in hashcat's master branch and is not in the 7.1.2 release, which prints . The letter names which directory the parts come from, and the number is both a length and a file name, so token that defines which letters to upper-case afterwards. seen Oct 2026 · source
Case-toggling charset tables documented Includes toggle tables covering Latin, Greek, and Cyrillic scripts, with per-letter bidirectional case mappings for use in candidate generation. 3 other sources

docs

  • holds 618 mappings covering Latin, Greek and Cyrillic, each letter decided separately and in both directions, so an upper-case letter can go down as well as a lower-case one going up. Applies to master, and the tables folder is not in the 7.1.2 release. seen Oct 2026 · source
  • hashcat advanced password recovery hashcat Forums Wiki Tools Events Converter Table of Contents Table Attack Description How a table works Running it Tables that ship with hashcat Settings Why maxperm exists Typed on the wrong keyboard layout Ideas for your own tables The wordlist as a set of patterns What changed… seen Sep 2026 · source
  • Converter Archived. It describes oclHashcat-lite, which was merged into one program in 2015. Read instead. This page is kept for reference and is listed in the Archive seen Sep 2026 · source
NTLMv1 hash handling script shipped Includes a dedicated Python script for processing and manipulating NTLMv1 hashes. 1 release · 1 other source · first seen Feb 2017

Also counts toward: Python scripting support, Scripting language support

release

example

  • Extract NTLM hashes from a CaptiveToNTLM formatted file. ./ct3_to_ntlm input.ct3 > output.ntlm v1.3 · Feb 2017 · source
DES key derivation for CT2 attacks verified Accepts a 16-char DES key hex value to support known-plaintext CT2 (chosen-plaintext/crack-the-hash-2) style attacks against NTLMv1. 2 other sources · first seen Sep 2025

Also counts toward: Command-line interface

command line

  • --nthash — 32-char hex NTLM hash to compute DES keys and hashcat candidates v1.10 · Sep 2025 · command-line history
  • --key2 — 16-char DES key hex for CT2 v1.10 · Sep 2025 · command-line history
Hash format conversion verified Converts NTLMv1 hashes into alternative formats such as $99$ and $MSCHAPv2$ for use with downstream cyber tooling. 2 other sources · first seen Sep 2025

command line

MSCHAPv2 capture processing verified Accepts MSCHAPv2 challenge/response lines and supports converting NTLMv1 hashes into MSCHAPv2 format for further analysis. 2 other sources · first seen Sep 2025

Also counts toward: Command-line interface

command line

  • --mschapv2 — MSCHAPv2 line in $MSCHAPv2$CHALLENGE$NTRESPONSE format v1.10 · Sep 2025 · command-line history
  • --to-mschapv2 — Convert NTLMv1 hash to $MSCHAPv2$ format v1.10 · Sep 2025 · command-line history
NTLMv1 hash cracking assistance verified Accepts NTLMv1 hashes in Responder format or as raw 32-char hex NTLM hashes and computes DES keys and hashcat candidates to aid in cracking. 2 other sources · first seen Sep 2025

command line

  • --nthash — 32-char hex NTLM hash to compute DES keys and hashcat candidates v1.10 · Sep 2025 · command-line history
  • --ntlmv1 — NTLMv1 hash (Responder format) v1.10 · Sep 2025 · command-line history
Rule-based candidate modification shipped Provides a rule language for transforming password candidates by changing, adding, or removing characters, with conditional rejection support. 1 release · 1 other source · first seen Feb 2017

Also counts toward: Command-line interface

release

docs

  • Rules are a small language for modifying password candidates. They can change, remove, or add characters and can use conditions to reject candidates. In version 7.1.2, -r works with -a 0 -a 9 . The current master branch supports -r in every attack mode. See hashcat.net/beta for a precompiled build. seen Oct 2026 · source
Session restore and job resumption documented Saves cracking session state to a restore file so that interrupted jobs can be resumed from where they stopped. 2 other sources

Also counts toward: Command-line interface

docs

  • --cpu-affinity=STR Locks to CPU devices, separate with comma + Indicates that the value is depending on GPU platform vendor. NVIDIA = 8, AMD = 160. The frequency when the restore-file is updated has changed with v0.07. It is now written asynchronously as soon as there is an update ready. seen Oct 2026 · source
  • near your hardware, with --restore you should be able to resume the cracking job. To disable the restore support you can use --restore-disable . seen Oct 2026 · source
Extended combinator length limit shipped Increases the maximum character length for password candidate generation by combinators from the previous limit to 512 characters. 1 release · first seen Sep 2025

release

  • Raises maximum length (LEN_MAX) to 512 characters for all combinators, enabling longer password candidate generation. v1.10 · Sep 2025 · source · release history
N-gram generation utility shipped Provides a companion utility for generating n-grams from wordlists to enhance candidate generation strategies. 1 release · first seen Sep 2025

release

  • Adds ngramX utility for n-gram generation from wordlists. v1.10 · Sep 2025 · source · release history
Permute performance optimization shipped Optimizes the permute operation by using an output buffer to improve execution speed. 1 release · first seen Sep 2025

release

  • Improves performance of permute by using an output buffer. v1.10 · Sep 2025 · source · release history
Potfile export utility shipped Provides a script to export the contents of the potfile (found passwords) for external analysis or backup. 1 release · first seen Sep 2025

Also counts toward: Python scripting support

release

  • Adds export_potfile.py script to export potfile contents. v1.10 · Sep 2025 · source · release history
Tmesis rule syntax extension shipped Extends the tmesis rule engine with support for hexadecimal escape sequences and non-7-bit-ASCII byte escaping in output. 1 release · first seen Sep 2025

release

  • Adds tmesis.pl support for \x rule syntax and escaping of non-7-bit-ASCII bytes in output. v1.10 · Sep 2025 · source · release history

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for hashcat-utils, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail hashcat-utils puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

Show

6 entries

  1. September 20251
  2. August 20181
  3. May 20171
  4. February 20173
    Show

    6 entries

    Project health

    Issue, contributor and maintainer activity in hashcat/hashcat-utils, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

    1. Contributors 3 −2 vs prior 12 months
    2. Maintainers 1 +1 joined · −1 left, last 12 months
    3. Bus factor 1 committers behind half the commits
    4. Community-filed 100% of issues opened, last 12 months
    5. Median time to close < 1 day first maintainer reply 14 hours
    6. Open backlog 17 of 60 issues ever filed
    1. Issues opened / month 0 · 0 communitymaintainers
    2. Open backlog 17
    3. Contributors / month 0
    4. Commits / month 0
    5. Stars 1,621
    Issue themes, last 12 months
    • other 100%

    Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

    Libraries its release ships

    What its latest release locks, checked against known advisories.

    None of its release's images build from a lockfile we can read.

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    browse all tools → score card for your toolchain →