Welcome to Hashcat! As one of the world's fastest and most advanced password recovery tool.

1. Basic Syntax

The general command structure is:

hashcat -m [hash_mode] -a [attack_mode] [hash_file] [wordlist_or_mask]

• -m (Hash Mode): specifies the algorithm (e.g. MD5, SHA1).
• -a (Attack Mode): specifies the strategy:
  • -a 0 — Straight (dictionary) attack
  • -a 1 — Combination attack
  • -a 3 — Brute-force / mask attack
  • -a 6 / 7 — Hybrid attacks (dictionary + mask, or vice versa)

2. Common Hash Modes (-m)

You must match the -m flag to the specific hash type you are targeting.

3. Essential Tips for Newcomers

• Identify first: if you are unsure what type of hash you have, use tools like HashID or Name-That-Hash before running Hashcat.
• Masking (?): in brute-force mode (-a 3), use masks to define character sets:
  • ?l — lowercase letters
  • ?u — uppercase letters
  • ?d — digits
  • ?a — all characters (lowercase, uppercase, digits, symbols)
• Session management: use --restore to resume an interrupted attack, and -o [file] to save cracked passwords to a specific file.
• Verification: always test your setup with a "known" hash (a hash of a password you created) to make sure your command syntax and hardware are working correctly before running long attacks.