Password hashing (a one-way transformation of a password into a seemingly random string) is the foundation of password storage security in every modern system. But an important question remains: how resistant is a given hash, really, against an attacker with powerful hardware? hashcat is the fastest and most widely used open-source tool for precisely answering that question — using the parallel processing power of a GPU instead of a CPU.
Important: this tutorial should only be run against hashes and systems you own, or in an authorized lab/training environment — like your own accounts or a formal penetration-testing engagement that covers hash access. Attempting to crack the password or hash of any system you don't have explicit authorization for is a crime.
Installing hashcat
sudo apt install hashcat
Step 1: Check your hardware's speed
hashcat -b
This runs a benchmark and shows how many hashes per second your graphics card can attempt across different hashing algorithms (MD5, SHA256, NTLM, etc.) — a number that directly shows how much faster a typical modern GPU is at this than a CPU.
Step 2: Create a sample hash to practice on
Before anything else, instead of using someone else's real hash, create a practice hash from a made-up password so you can practice completely safely and legally:
echo -n "Test1234" | sha256sum
Save this command's output into a file named hash.txt.
Step 3: Dictionary attack
hashcat -m 1400 -a 0 hash.txt wordlist.txt
-m 1400 specifies the hash algorithm type (SHA256 here; 0 is used for MD5, 1000 for NTLM). -a 0 means the attack mode is a dictionary attack — trying every word from a wordlist file. If your password is in that word list, it'll be found within seconds.
Step 4: Mask attack (smart pattern-based guessing)
hashcat -m 1400 -a 3 hash.txt ?u?l?l?l?l?l?l?d
-a 3 means mask attack mode — instead of trying words from a list, you specify the password's structure (here: one uppercase letter, six lowercase letters, one digit). This is useful when you have a rough idea of the password's structure — exactly what many "predictable" human passwords (like Ali1234) are vulnerable to.
Step 5: Combining a wordlist with rules (rule-based attack)
hashcat -m 1400 -a 0 hash.txt wordlist.txt -r rules/best64.rule
Rules tell hashcat to also try common human variations on each word in the list — like appending a digit at the end, capitalizing the first letter, or substituting characters with lookalikes (like a to @). This is exactly the pattern most real users apply to "strengthen" their password, and exactly the pattern this attack specifically targets.
Reading the result
If hashcat finds the password, it displays it at the end of the line, next to the hash itself. To see previous results again without rerunning:
hashcat -m 1400 hash.txt --show
Why is this exercise useful for a system administrator?
Many organizations never know how weak their users' passwords really are until a data breach happens. An informed sysadmin can (with formal authorization, on the organization's own hashes) periodically run this exact test to identify and fix weak passwords before a real attacker does — exactly the proactive approach taught in my security courses.
Blog