How to Use Hashcat: 7 Powerful Password Audit Steps

Hashcat is an offline password auditing and recovery tool that compares password candidates against cryptographic hashes, using CPUs, GPUs, and other supported compute devices. If you want to learn how to use Hashcat, the useful beginner path is not to throw a giant wordlist at random hashes. It is to create your own test hashes, identify the correct hash type, choose an attack mode that matches your hypothesis, read the result, and then improve the password policy that failed.

This guide, How to Use Hashcat: 7 Essential Password Audit Steps, follows that workflow with deliberately created lab hashes. You will see practical Hashcat examples, a Hashcat wordlist, a Hashcat mask, common attack modes, and enough context to understand what the terminal is actually telling you.

If you like practical lab work, security notes, and lessons learned from actually testing tools instead of merely admiring their flags, you can join the HackersGhost newsletter. I keep it focused on usable cybersecurity experiments, privacy, and ethical hacking workflows.

Everything here assumes passwords, hashes, systems, and files you own or are explicitly authorized to audit. Hashcat works offline, which makes it excellent for controlled password-strength testing. Scope remains your responsibility.

Password audit step	What you learn	Beginner value
Create and identify test hashes	Why the hash mode matters	Prevents meaningless runs
Use wordlists, masks, and rules	How candidate strategies differ	Builds practical intuition
Interpret results and improve policy	What weak passwords reveal	Turns cracking into defense

Key Takeaways Before You Learn How to Use Hashcat

• Hashcat is primarily an offline tool. It does not log into Gmail, social networks, or other online accounts for you; it tests candidate passwords against hashes you already possess lawfully.
• The correct hash type matters more than speed. A fast attack against the wrong mode is simply a very efficient way to get nowhere.
• A small, relevant Hashcat wordlist is often better for learning than a gigantic list you do not understand.
• Hashcat attack modes represent different assumptions. Dictionary, combinator, mask, hybrid, and association attacks are not interchangeable decorations.
• A mask pattern is especially useful when you know the structure of a test password but not every character.
• Running Hashcat inside a VMware guest is fine for small learning exercises, but it is not automatically a fair GPU benchmark.
• The best reason to learn how to use Hashcat is defensive: weak passwords become much easier to explain when you can demonstrate exactly why they fall.

What Is Hashcat and How Does Hashcat Work?

If you are asking what is Hashcat, think of it as a high-performance candidate tester. You give Hashcat a hash or hash file, tell it what kind of hash it is, choose how candidate passwords should be generated, and let it compare those candidates against the target. When a candidate produces the same hash, Hashcat can report the matching plaintext.

That answers the beginner version of how does Hashcat work. The interesting part is candidate generation: Hashcat can read dictionaries, combine words, apply rules, generate masks, or mix strategies. The official Hashcat project documents these modes. Real password auditing is usually about testing a hypothesis, not generating every possible string until the universe gets bored.

For example, if I create a lab password such as GhostLab42!, I already know something about its structure. A dictionary may find it if the exact password is present. A rule can mutate a base word. A mask can test a known pattern such as letters followed by two digits and a symbol. Each approach answers a slightly different question about password strength.

HackersGhost Note: I get more value from Hashcat when I start with a theory. “Could a user-created word plus two digits be guessed quickly?” is a useful audit question. “What happens if I launch the largest wordlist I can find?” is mostly a storage benchmark wearing a hacker hoodie.

My Lab Setup for Learning How to Use Hashcat

I do most of my lab work on a second-hand HP EliteBook that I upgraded with another 16 GB of RAM, bringing it to 32 GB. I chose VMware for my current virtual lab and keep both Kali Linux and Parrot OS available, although Parrot OS is the system I use most often. For learning how to use Hashcat, that setup is more than enough because the examples in this guide deliberately use tiny test datasets.

There is one important caveat. Hashcat can take excellent advantage of GPUs and other compute devices when they are exposed correctly, but a virtual machine does not magically inherit the full native GPU path of the host. My 32 GB of RAM makes the EliteBook comfortable for VMs, yet RAM capacity is not the main thing that determines Hashcat speed. If I benchmark inside a guest without proper GPU access, I am benchmarking that virtualized environment, not the theoretical capability of the laptop.

My Cudy WR3000 and ProtonVPN Secure Core setup protects normal external traffic, but it is not part of this audit. Hashcat works locally against offline hashes, so the VPN has nothing useful to accelerate here.

HackersGhost Note: This is one reason I like Hashcat for beginner lab work. The exercise can be completely self-contained. I create the password, create the hash, create the candidate list, run the audit, and know exactly where every piece of data came from.

John the Ripper Password Cracking: 7 Smart Lab Steps

John the Ripper Password Cracking: 7 Smart Lab Steps

Step 1: Install Hashcat and Check Your Environment

On Kali Linux, Hashcat is available through the package manager. The Kali Linux project documents the package and the standard installation command. On Parrot OS or another Debian-based environment, the same package-manager approach is normally the first place I check.

sudo apt update
sudo apt install hashcat

Then verify that Hashcat responds and inspect the available options:

hashcat -V
hashcat -h
hashcat -hh

The short help is enough to confirm the binary works. The extended help is useful when you want to inspect supported modes. If you are learning how to use Hashcat, get comfortable checking help instead of trying to memorize several hundred hash identifiers. Memory is for remembering why you opened the terminal in the first place.

You can also inspect compute devices before assuming Hashcat is using the hardware you expect:

hashcat -I

That output matters in VMware. If the guest only sees a CPU-oriented compute device, treat the result as a VM result, not a native GPU benchmark.

Step 2: Create Safe Hashcat Example Hashes Yourself

The cleanest way to learn how to use Hashcat is to generate your own Hashcat example hashes. That removes ambiguity around authorization and lets you verify the answer before Hashcat ever starts.

Start with a simple MD5 example. MD5 is not what I recommend for storing real passwords; I use it here because the format is straightforward and makes the mechanics easy to see.

printf 'GhostLab42!' | md5sum | awk '{print $1}' > lab-md5.hash
cat lab-md5.hash

You now have a hash that came from a password you chose. For a SHA-256 learning example:

printf 'GhostLab42!' | sha256sum | awk '{print $1}' > lab-sha256.hash
cat lab-sha256.hash

These are useful example hashes because you control both sides of the experiment. If something fails, you can troubleshoot the command instead of wondering whether the source hash was malformed, salted, truncated, copied incorrectly, or produced by a completely different scheme.

HackersGhost Note: I prefer generating my first hashes locally because it turns the exercise into science instead of archaeology. I know the input, the expected result, and the exact moment I made the mistake.

Step 3: Understand Hashcat Hash Types Before You Attack

Hashcat hash types are identified by numeric modes. For the two test files above, raw MD5 uses mode 0 and raw SHA-256 uses mode 1400. Other formats use different identifiers because password storage formats can involve salts, iterations, encodings, and application-specific structures.

For reproducible beginner work, I prefer to specify the mode explicitly:

hashcat -m 0 -a 0 lab-md5.hash lab-wordlist.txt
hashcat -m 1400 -a 0 lab-sha256.hash lab-wordlist.txt

Do not treat those two mode numbers as a universal cheat code. When learning how to use Hashcat, verify the hash type for the format you are auditing. Hashcat can help identify possible formats in some situations, but identification is not always unique. Several hash formats can look similar at a glance.

Hashcat hash types also teach an important defensive lesson: different password-hashing schemes impose very different costs on each candidate guess.

Step 4: Build a Small Hashcat Wordlist You Actually Understand

A Hashcat wordlist is simply a file containing candidate passwords, usually one per line. For the first audit, I intentionally include the correct answer so I can prove the full workflow is functioning.

cat > lab-wordlist.txt <<'EOF'
Password123
GhostLab
GhostLab42!
SummerTest
CorrectHorseBattery
EOF

Now run the MD5 test:

hashcat -m 0 -a 0 lab-md5.hash lab-wordlist.txt

Because the exact password is present, Hashcat should be able to match it quickly. To display previously recovered results for that hash file:

hashcat -m 0 lab-md5.hash --show

This is the simplest useful lesson in how to use Hashcat: the tool is not “decrypting” MD5. It is generating a candidate, hashing that candidate in the appropriate way, and comparing the result. If the hashes match, the candidate is the answer.

After the controlled success, remove GhostLab42! from the candidate list and rerun it. You should now see the attack complete without recovering the password. That failed run is valuable. It proves that a dictionary attack can only test the candidates it is given or derive through additional transformations.

HackersGhost Note: “Exhausted” is not the same as “broken.” It can simply mean Hashcat tested the available candidate space and did not find a match. That distinction saves a surprising amount of beginner troubleshooting.

Step 5: Learn the Main Hashcat Attack Modes

The next step in learning how to use Hashcat is understanding why different Hashcat attack modes exist. The mode tells Hashcat how to create candidates. I would learn these conceptually before collecting command lines.

Dictionary Attack: Mode 0

Mode 0 reads candidates from a wordlist. This is the easiest place to start because every candidate is visible in a file you can inspect. It is excellent for demonstrating why common, leaked, company-themed, or predictable passwords are dangerous in an authorized audit.

Combinator Attack: Mode 1

Mode 1 combines entries from two dictionaries. It is a neat way to demonstrate why joining two ordinary words does not automatically create a strong password.

Mask Attack: Mode 3

Mode 3 generates candidates from a pattern. A Hashcat mask is powerful when the structure is known or suspected. It can be far more efficient than testing every character in every position.

Hybrid Attacks: Modes 6 and 7

Hybrid modes combine a wordlist and a mask, which is useful for patterns such as a word followed by digits. Defensively, they show why adding two numbers is not the same as adding real entropy.

Association Attack: Mode 9

Association mode tests candidates tied to specific hashes using related information. I would leave this until you are comfortable with simpler Hashcat attack modes. The beginner goal is to understand candidate strategy, not to complete the entire help menu before lunch.

Step 6: Use a Hashcat Mask Instead of Blind Brute Force

A Hashcat mask lets you describe the character set expected at each position. Common placeholders include ?l for lowercase letters, ?u for uppercase letters, ?d for digits, ?s for special characters, and ?a for a broad printable character set.

Instead of testing an enormous completely unconstrained space, create another lab password with a deliberately predictable structure:

printf 'cat42!' | md5sum | awk '{print $1}' > mask-demo.hash

If I already know the audit password consists of three lowercase letters, two digits, and one symbol, this Hashcat mask describes that exact pattern:

hashcat -m 0 -a 3 mask-demo.hash '?l?l?l?d?d?s'

This is a good way to learn Hashcat without turning the exercise into an endurance contest. You know the answer, you know the pattern, and you can see how shrinking the candidate space changes the job.

The defensive lesson is more important than the command. Human password habits often have structure: capital letter first, word in the middle, digits at the end, symbol added because the website demanded one. A password can satisfy a complexity rule while still being highly predictable. Mask-based auditing makes that visible.

HackersGhost Note: Complexity rules can create patterns instead of entropy. If everybody learns to turn ghost into Ghost42!, the exclamation mark has not joined the security team. It has joined the pattern.

Step 7: Read the Result and Turn It Into a Better Password Policy

The final step in using Hashcat well is the one I think beginners skip too quickly: interpretation. Recovering a lab password is not the finish line. The useful question is why that password was recovered under the chosen assumptions.

• Found in a small dictionary: the password itself was predictable or reused from a known list.
• Found after simple rules: the base word may have been predictable and the transformation too common.
• Found with a narrow Hashcat mask: the structure may have been predictable even if the exact characters were not known.
• Not recovered: this does not prove the password is strong; it proves the tested candidate strategy did not find it.

That last point matters. If a five-minute dictionary run fails, I do not write “secure password” in a report. I write what I tested, what candidate source I used, what mode I used, what limits applied, and what the result actually means. A people-first password audit should produce advice a human can act on, not a dramatic score.

In practice, the fix usually involves unique passwords, sufficient length, less predictable construction, multi-factor authentication where available, and a password manager. That is where an audit becomes useful: you are connecting evidence from the test to a better everyday habit.

Password Cracking: 7 Reasons Weak Passwords Fail Fast

Password Cracking: 7 Reasons Weak Passwords Fail Fast

What I Do After a Password Audit: Use a Password Manager

Hashcat is good at demonstrating the problem. It is not the tool I use to solve the everyday problem of remembering dozens of unique credentials. After learning how to use Hashcat, the practical next step is to stop creating passwords that depend on memory tricks in the first place.

For that job, I prefer a password manager that can generate long random passwords, store them in an encrypted vault, and autofill them so I do not need to reuse a familiar pattern. NordPass fits naturally here because it is built specifically around password management, passkeys, autofill, password generation, and password-health features. I see it as the defensive side of the same lesson Hashcat teaches in the lab.

This is an affiliate link. I use password auditing to show where predictable credentials fail; a password manager helps remove the human habit of reusing or slightly modifying those credentials.

My Hashcat Cheat Sheet for Beginner Audits

I keep a small Hashcat cheat sheet because the point is understanding the workflow, not winning a memory contest.

• -m — choose the hash type.
• -a — choose the attack mode.
• -I — inspect available compute backends and devices.
• -h — display normal help.
• -hh — display extended help including hash modes.
• --show — display recovered hash results.
• -r — apply a rule file to wordlist candidates.
• --session — name a session so it is easier to identify later.
• --restore — restore a supported interrupted session.
• -b — run a benchmark; useful for your own hardware context, not as proof that every real audit will perform the same way.

Beginner Mistakes I Would Avoid With Hashcat

Choosing a Hash Type by Guessing

If you are learning how to use Hashcat, do not pick a mode because the hash merely “looks like MD5.” Confirm the source format whenever possible. A wrong mode can make a valid wordlist look useless.

Assuming a Failed Attack Means a Strong Password

A dictionary miss proves only that the candidate was not found in that tested set after any transformations you applied. Change the candidate source or strategy and the outcome may change. Report the method, not a magical verdict.

Benchmarking a VM and Blaming Hashcat

This one is close to home for me. My Parrot OS VM is excellent for learning how to use Hashcat, but I do not treat it as a native GPU benchmark unless I have verified the actual compute device exposed to the guest. Virtualization changes the hardware path.

Starting With Huge Wordlists

Large lists have uses, but they can hide the learning process. Begin with a handful of candidates you understand, then change one variable at a time.

Collecting Commands Without Understanding Them

A copied command can work once and still teach almost nothing. I would rather explain a few Hashcat examples properly than publish forty commands with no reasoning behind them.

A Book That Fits This Kind of Hands-On Lab Work

If you prefer learning tools inside a broader ethical-hacking workflow, Ethical Hacking: A Hands-on Introduction to Breaking In is useful background reading rather than a substitute for hands-on command practice.

I use books for context, then validate the ideas myself. For how to use Hashcat, the lab remains the important part.

Is Hashcat Worth Learning for Beginners?

Yes. For password auditing and ethical hacking, learning how to use Hashcat is worthwhile because it makes password weakness measurable and forces you to think about candidate strategy and test limits.

The first useful experiment can be tiny. My VMware setup on an upgraded second-hand EliteBook is enough to teach the workflow; native GPU acceleration matters later when performance itself becomes the subject.

The larger lesson is defensive: length, uniqueness, randomness, and password managers make more sense after you have seen predictable construction fail under controlled conditions.

Final Thoughts: How to Use Hashcat Without Losing the Point

This guide on how to use Hashcat started with a simple idea: build the audit yourself. Create a password, create the hash, select the correct mode, test a small dictionary, try a mask attack, read the result, and turn that result into better password guidance.

The seven essential password audit steps are useful because they keep the terminal attached to a reason. Hashcat can be extremely fast on the right hardware, but speed is only helpful when the test is correctly designed. A wrong hash type, irrelevant wordlist, or misunderstood result does not become more insightful because it happened at several billion guesses per second.

If you remember one thing about how to use Hashcat, make it this: the tool tests your assumptions about passwords. Good password auditing is not about celebrating a crack. It is about discovering which assumptions were accurate, documenting the limits of the test, and making the next password much less predictable.

Frequently Asked Questions