Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was wondering whether JtR is a good solution to test password strength. I'm not interested in actually finding the passwords (I'd rather not in fact), what I'd like is to run JtR in a way which would allow me to say "User A, I think you ought to choose a better password, it's really rather weak; user B, your password is decent but could be improved a little; user C, well done, your password is strong" in order to do a bit of user education. Is there a way to get JtR to only say how long it's been running when it's found a match rather than record the password in the .pot file? Is there a better way to do this? And no, before you say it, I know it'd be perfect if I could just say, passwords should respect such standards but that's unfortunately not an option currently.


share|improve this question
If john finds the password at all, it is much too weak. There are already tools which are faster by several orders of magnitude, and which become faster still with more hardware thrown at them. – Michael Hampton Feb 10 '14 at 14:08
@MichaelHampton What tools do you suggest? – ewwhite Feb 10 '14 at 14:13
If you're dealing with information that should be well protected (Financial or Health essentially) you really need to consider Two Factor authentication. People pick terrible passwords, even with "strict" requirements. You can warn, shame, scold people all you want- they'll still do it. – Chris S Feb 10 '14 at 14:20
@MichaelHampton yes, there are more powerful tools, there always are, but that's not the point since I'm trying to help those who have the weakest passwords first and that should remain true pretty much regardless of the tool; – Oliver Henriot Feb 10 '14 at 15:15
@ChrisS no, luckily I'm not and I'm not trying to warn, shame or scold (ok, maybe warn a little...), merely identify which of my users most need my help to secure their data – Oliver Henriot Feb 10 '14 at 15:18

I do this all the time...

Using John to run a quick scan of a password file for my customers helps me stress the importance of better password policies. And it does allow some targeting of users with especially weak passwords.

If in an few minutes, I can come up with output like below, it's a good call-to-action:

share|improve this answer
Yes but then you know your user passwords which I'd rather not do and also you have no means other than your own judgement to say which of the passwords in the list is the weakest. But I quite agree with your point though. – Oliver Henriot Feb 10 '14 at 15:05
@OliverHenriot If any passwords are discovered by this scan, they're immediately deemed too weak. So at that point, they should be changed. – ewwhite Feb 10 '14 at 15:10

I'm with everyone else - if you, with your tiny resources and limited patience, can find any passwords, then the attacker with a few (friends with) PC's with 8 Radeon R290X's each, who decides to spend a month or two on just your password file, and who is much, much more experienced than you, with better wordlists and rulesets, is definitely going to find them.

If you really insist on ranking by weakness, then do attacks in sequence, smallest exhaustive keyspace first. For instance (keyspaces are rough estimates, NOT precision calculations):

  • Rules-based exhaustive dictionary attack with the tiny phpbb dictionary of 184389 words and the Best64 ruleset is 1E7
  • Markov/brute force exhaustive of 8 character passwords of all digits are 1E8
  • Mask attack of the tiny phpbb dictionary of 184389 words with a suffix of all numbers between 0 and 999, both with and without a trailing !, is 3E8
  • Rules-based exhaustive dictionary attack with the tiny phpbb dictionary and the excellent d3ead0ne ruleset of 35404 rules is 6E9
  • Markov/brute force exhaustive of 8 character passwords of 5 lower case characters but always ending with 123 are 26^5, or 8E9
  • Markov/brute force exhaustive of 8 character passwords of 8 lower/numeric characters is 2E12
  • Rules-based exhaustive dictionary attack with the InsidePro Full dictionary of 154045162 words and the excellent d3ead0ne ruleset of 35404 rules is 5E12
  • ....
  • Markov/brute force exhaustive of 8 character passwords of 8 lower/upper/numeric characters is 2E14
  • ....
  • Rules-based combinator exhaustive attack of the tiny phpbb dictionary of 184389 words crossed with InsidePro Full and then applying the InsidePro Full dictionary of 154045162 words and the excellent d3ead0ne ruleset of 35404 rules is 1E18
  • Again, if ANY of these find a password, it's weak.
  • There are nearly infinite variants within this, of course, but I find it useful to run the fastest attacks first, so that on per-user salted passwords, the more expensive attacks are used against the fewest possible hashes
    • I.e. run a 1E8 attack first, and remove all the hashes that it finds from the list. Then do your 3E8 attack, remove those, and move up, so you don't try a 1E14 attack on a password that could have been removed with orders of magnitude less work.

I was wondering whether JtR is a good solution to test password strength. I'm not interested in actually finding the passwords (I'd rather not in fact)

John the Ripper is a good tool, but it is not always the best tool.

Currently, for many hashes, oclHashcat is the best free tool I'm aware of, and the option to hide found passwords is a combination of

  • --disable-potfile
  • --outfile-format=NUM
    • 1 = hash[:salt]

i.e. add to your command line

   --outfile-format=1 --disable-potfile

I usually pull in the result file

On the paid side, Elcomsoft has a wide variety of tools available; to cite one example, their Proactive Password Auditor, at least, has an option to hide found passwords.

In either case, budget at least one GPU of whatever type is best for the software you choose.

In any case, learn the various modes - pure Markov mode/brute force for limited character sets (including some keywalking sets), and then very quickly graduate to rules based dictionary attacks. Make dictionaries including common words at your company, phone numbers, addresses, the phone list, etc. and add that to common dictionaries like online Scrabble word lists, phpbb, insidepro, rockyou, crackstation, clearmoon247, or myslowtech.

If you need a dictionary with a clear license, while it's not good for cracking, the English Open Word List license is:

UK Advanced Cryptics Dictionary Licensing Information:

Copyright © J Ross Beresford 1993-1999. All Rights Reserved. The following restriction is placed on the use of this publication: if the UK Advanced Cryptics Dictionary is used in a software package or redistributed in any form, the copyright notice must be prominently displayed and the text of this document must be included verbatim.

There are no other restrictions: I would like to see the list distributed as widely as possible.
share|improve this answer

I'd think to iterate using brute force over a list/database of users cracking each of their passwords would be hugely wasteful and take a very long time.

Consider that you don't know much about their passwords, so you don't know if there's any letters, uppercase, lowercase, password length or special characters.

So within JTR you're going to have to specify a huge character set to work from and that could take (even on a fast server) several days, weeks or more to crack each password.

There's also user trust issues surrounding emailing them to let them know you've sussed their password and consider it to be weak.

It's best to just enforce minimum strength requirements when they're creating their password.

share|improve this answer
Running JTR on each account with a 1-10 minute timeout would work nicely, though. If it cracks it with the initial dictionary attacks, common passwords, etc. you warn them, otherwise you move on. – ceejayoz Feb 10 '14 at 15:03
Actually, I unfortunately have all too good knowledge of the passwords of some of the users I'm targeting... Out of experience, some passwords stored on decommissioned machines fell within minutes. I'm praying the users have used better passwords on replacement servers. Unfortunately I have little to no means to enforce minimum password requirements on all services so education is of the essence here. – Oliver Henriot Feb 10 '14 at 15:11
Yes, that's probably my best shot @ceejayoz, thanks – Oliver Henriot Feb 10 '14 at 15:12

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.