Before hashcat became popular with its GPU acceleration, John the Ripper (usually called "John" or "JtR" in the security community) was the primary standard for password-strength auditing for decades — and it's still one of the most widely used tools, especially for Unix/Linux password files.
Important: this tutorial should only be run against hashes and systems you own, or in an authorized lab/training environment — like your own accounts or a formal penetration-testing engagement that covers hash access. Attempting to crack the password or hash of any system you don't have explicit authorization for is a crime.
Installing John the Ripper
sudo apt install john
Step 1: Understanding password structure on Linux
On Linux systems, usernames are stored in the /etc/passwd file, but the actual password hash (for security reasons) is stored in a separate file called /etc/shadow, accessible only to the root user. To audit these accounts' passwords, these two files first need to be combined.
Step 2: Combining the passwd and shadow files
On a Linux system you're authorized to work on (like your own lab VM), as root, run:
sudo unshadow /etc/passwd /etc/shadow > combined.txt
The unshadow tool merges these two files into a format John can read directly.
Step 3: Running your first audit
john combined.txt
By default, John first tries "Single Crack" mode (guesses based on the account's own information, like the username), then automatically switches to its built-in default wordlist mode.
Step 4: Using a custom wordlist
john --wordlist=rockyou.txt combined.txt
rockyou.txt is one of the most famous password lists in the security industry (sourced from a real data breach years ago) and comes pre-installed on security distributions like Kali — using it is one of the fastest ways to find common, weak passwords.
Step 5: Adding transformation rules
john --wordlist=rockyou.txt --rules combined.txt
Like hashcat, John also supports rules — trying common human variations (appending a digit, changing letter case, etc.) on each word in the list.
Step 6: Viewing found results
john --show combined.txt
This command shows the list of every password found so far, next to its corresponding username — with no need to rerun the whole process.
How does John differ from hashcat?
John traditionally runs on the CPU (its Jumbo edition also supports GPU, but hashcat is still known to be faster at that), but John's main strength is its broad, automatic hash-format detection (especially older, Unix-specific formats) and how remarkably simple it is to get an audit started quickly — which is exactly why it still holds a permanent spot in every security professional's toolkit, alongside hashcat.
Why is this skill essential for a Linux system administrator?
Any organization running Linux servers needs to periodically make sure its user accounts (especially old or rarely used ones) don't have weak passwords. Regularly running John the Ripper against the organization's own hashes is exactly the proactive step covered in my Linux security and penetration testing courses.
Blog