Skip to content
THREATWIRE

John the Ripper

Offline password security auditing

Openwall's long-standing password cracker; the community "jumbo" version supports hundreds of hash and cipher types on CPUs and GPUs.

Open sourceGPL-2.0-or-laterDual-use
Visit website View repository Docs
Homepage of John the Ripper
Official website (openwall.com), captured by ThreatWire.

What John the Ripper does

John the Ripper detects hash types automatically and runs wordlist, rule-based and incremental modes to find weak passwords. The jumbo edition in this repository adds support for hundreds of formats and helper tools (the *2john scripts) that extract hashes from files such as archives and documents.

It is used by administrators and auditors to check password strength. Like other crackers it is dual-use and should only be run against data you are authorised to audit.

Key features

  • Automatic hash type detection
  • Wordlist, rules, incremental and mask modes
  • Hundreds of hash and cipher formats (jumbo)
  • Hash extraction helpers for many file types
  • OpenCL GPU support for many formats

Licence

GPL-2.0-or-later · GNU GPL v2 or later, with exceptions · Open source

GitHub does not detect the licence. doc/LICENSE grants GPL v2 or later with an OpenSSL linking exception; some files use more permissive terms.

Checked by ThreatWire against the repository's licence file on 2026-10-20. GitHub detects: NOASSERTION.

Security of John the Ripper itself

No published advisory found for John the Ripper in GitHub repository advisories. That does not mean the tool has no vulnerabilities.

Sources: GitHub repository advisories · checked 2026-10-20.

Categories and tags

Passwords and credential auditing#password-audit#cpu#gpu#openwall#john#c#ripper#password#jtr#opencl

Related tools

  • KeePassXC

    Offline, cross-platform password manager

    Community port of KeePass for Windows, macOS and Linux that stores passwords in an encrypted KDBX database file you control.

    Stars
    29k
    Forks
    2k
    Last commit
    1 day ago
    GPL-2.0-only OR GPL-3.0-onlyOpen sourcePasswords and credential auditing
    Alternative to1Password

  • hashcat

    GPU-accelerated password recovery

    Password recovery and hash auditing tool that uses GPUs and CPUs to test passwords against hundreds of hash types.

    Stars
    27k
    Forks
    3.6k
    Last commit
    today
    MITOpen sourcePasswords and credential auditingDual-use
Share on X@threatwire_https://www.threatwire.tech/tools/john-the-ripper