Hashcat
GPU cracking.
Hashcat is a free Ethical Hacking Academy lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Ethical Hacking Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
What Is Hashcat?
Hashcat is the world's fastest password recovery tool. It uses the GPU to compute billions of hashes per second, supports hundreds of hash types, and is the de-facto standard for offline cracking.
Hash Modes (-m)
Each algorithm has a numeric mode. You must tell Hashcat what kind of hash you are attacking with -m.
-m 0MD5-m 100SHA1-m 1000NTLM-m 1800sha512crypt (Linux)-m 22000WPA-PBKDF2
Attack Modes (-a)
The attack mode sets the strategy.
-a 0straight (wordlist)-a 1combination (two wordlists)-a 3brute force / mask-a 6wordlist + mask-a 7mask + wordlist
Identifying the Hash
Before cracking you must know the hash type. Tools like hashid or name-that-hash guess the algorithm from the hash format. A 32-char hex string is likely MD5 or NTLM; $6$ prefix is sha512crypt.
hashid "$6$rounds=...$abc..."
name-that-hash -t 5f4dcc3b5aa765d61d8327deb882cf99A Basic Dictionary Attack
The simplest run: straight mode against a wordlist.
hashcat -m 0 -a 0 hashes.txt rockyou.txtAdding Rules
Layer a rule file onto the wordlist with -r to apply mutations and greatly increase coverage.
hashcat -m 1000 -a 0 ntlm.txt rockyou.txt -r best64.ruleMask Attacks
For brute force, a mask describes the character set per position. ?l=lowercase, ?u=upper, ?d=digit, ?s=symbol, ?a=all. Useful when you know the password pattern.
hashcat -m 0 -a 3 hashes.txt ?u?l?l?l?l?d?d?d
# Capital + 4 lower + 3 digitsPerformance and Workload
-w sets the workload profile (1=low, 4=insane). Higher profiles use more GPU but may make the machine unresponsive. --status prints live speed; benchmark with hashcat -b.
hashcat -b -m 1000 # benchmark NTLM
hashcat -m 0 -a 0 hashes.txt rockyou.txt -w 3The Potfile and Restoring
Cracked hashes are stored in hashcat.potfile so they are never re-cracked. Use --show to display already-cracked results, and --restore to resume an interrupted long-running session.
hashcat -m 0 hashes.txt --show
hashcat --restore --session crack1Salts and Slow Hashes
Salted, slow hashes (bcrypt, sha512crypt, Argon2) are designed to resist GPUs — each guess costs far more. Cracking speed drops from billions/sec to thousands/sec, which is exactly why such algorithms protect real passwords.
Legal Use Only
Hashcat is offline: it works on hash files you already possess. Possess and crack hashes only from systems you own or are authorized to assess. Cracking stolen credentials is illegal regardless of intent.
Quick Check
Test your Hashcat knowledge.
Recap
You learned GPU cracking with Hashcat:
-mpicks the hash mode,-athe attack mode- Identify hashes with hashid / name-that-hash
- Combine wordlists,
-rrules, and-a 3masks - The potfile stores cracks; slow salted hashes resist GPUs
Next: the versatile John the Ripper.
Frequently asked questions
Is the “Hashcat” lesson free?
Yes — the full text of “Hashcat” is free to read here on the web, and the Ethical Hacking Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Ethical Hacking Academy course, upgrade to CoddyKit PRO.
What will I learn in “Hashcat”?
GPU cracking. You practise Ethical Hacking Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Ethical Hacking Academy?
No prior experience is required. Ethical Hacking Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Hashcat” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Ethical Hacking Academy lesson?
Yes. Every Ethical Hacking Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.