# John the Ripper

> Master the ultimate field-testing Swiss Army Knife. Learn to auto-detect obscure hashes, crack encrypted archives (ZIP, RAR, PDF), and extract SSH keys using John the Ripper.

Canonical: https://codelivly.com/rooms/john-the-ripper
Last updated: 2026-07-15

| | |
|---|---|
| Level | Intermediate |
| Category | Cybersecurity |
| Lessons | 5 |
| Estimated time | 30 min |
| XP | 200 |

Hashcat is the muscle; John the Ripper (JtR) is the scalpel. Amateurs think JtR is just an outdated, CPU-bound alternative to Hashcat. When they encounter a weird hash format or an encrypted PDF, they assume it's uncrackable.

Professionals know that John the Ripper is the most versatile password cracking tool in existence. While Hashcat requires heavy GPU drivers and struggles with non-standard formats, JtR runs natively on any Unix-like system, auto-detects over 300 obscure hash formats, and includes a massive ecosystem of extraction scripts (zip2john, ssh2john, pdf2john). When you are in the field, armed with only a laptop and a bag of encrypted files, JtR is the tool that gets you inside.

In this module, we transition from raw GPU hash-cracking to versatile, file-based credential recovery. You will learn to extract hashes from encrypted archives, recover passphrases from SSH private keys, auto-detect unknown hash formats, and seamlessly bridge JtR's extraction capabilities with Hashcat's raw GPU power.

## Lessons

1. What is John the Ripper & When to Use It Over Hashcat (30 min)
2. Cracking Modes — Single, Wordlist, Incremental (30 min)
3. Custom Wordlist Generation with Crunch & CeWL (30 min)
4. Cracking Password-Protected Files (30 min)
5. Guided Lab: Cracking a Protected SSH Private Key (30 min)

## Related

- [Learning path: Credential Attacks](https://codelivly.com/learning-paths/credential-attacks)
- [All rooms](https://codelivly.com/rooms)