Some hash types require specific tools or steps before hashcat can use them. This page collects details that are more involved or change more often than the information shown by --hash-info.

Editing note: For simplicity and future-proofing, start each section title with the mode ID, and sort each section by hash ID.

Conversion: Some formats, such as those inside archive files, documents, or full-disk encryption containers, must be extracted, modified, or converted before hashcat can attack them. Rather than reinventing the wheel, hashcat often recommends John the Ripper's conversion scripts (the '-2john' files in the JtR distribution). If your conversion script is not listed here, look there.

• Convert: 7z2john.pl - see script source for context
• Convert: hc_to_7z - WIP by philsmd

• Convert: https://github.com/philsmd/itunes_backup2hashcat

• Convert: https://github.com/philsmd/itunes_backup2hashcat

• Convert: office2john.py

• Known incompatibility with truecrypt2john, see this issue
• Old conversions will not write to potfile (can use outfile for this)
• Latest conversion scripts (tools/veracrypt2hashcat.py, tools/truecrypt2hashcat.py) produce normal hashes that will write to the potfile, using 294xx (VeraCrypt) and 293xx (TrueCrypt) modes.

• Convert: luks2hashcat.py
• (Older convert: luks2john.py)

The format expected by hashcat is:

SCRYPT:16384:8:1:OTEyNzU0ODg=:Cc8SPjRH1hFQhuIPCdF51uNGtJ2aOY/isuoMlMUsJ8c=

… but the format of most /etc/shadow yescrypt hashes is:

$y$jC5$mvBhUbBxNn1$y0uUAyiNRvM2pAa1kKoYFJ2QqGcYONT.n5IreOKA1/4

(converter link TBD)

• Deprecated, see this thread and this FAQ
• Use 22000/22001 instead

• Deprecated, see this thread and this FAQ
• Use 22000/22001 instead

• Convert: 1password2john.py - see script source for context

• Convert: 1password2john.py - see script source for context