Hash format guidance

Some hash types need specific tools and techniques to extract or otherwise prepare for use with hashcat. Some of these details or hints are more complex or more dynamic than what's available in –hash-info. This page is a place to keep them.

Editing note: For simplicity and future-proofing, start each section title with the mode ID, and sort each section by hash ID.

General guidance

Conversion: Some formats - such as those inside larger containers like archive files, documents, full disk encryption, etc. - have to be extracted / modified / converted before hashcat can attack them. Rather than reinventing the wheel, hashcat often recommends John the Ripper's conversion scripts (the '-2john' files in the JtR distribution). If your conversion script is not listed here, try there.

Archives

11600 - 7-Zip

14700 - iTunes backup < 10.0

14800 - iTunes backup < 10.0

Documents

9400 - MS Office 2007

Full-Disk Encryption (FDE)

Veracrypt

  • Known incompatibility with truecrypt2john, see this issue

14600 - LUKS

Password Managers

6600 - 1Password, agilekeychain

8200 - 1Password, cloudkeychain

Except where otherwise noted, content on this wiki is licensed under the following license: Public Domain