hashcat / John
What it’s for
Offline password crackers: they recover plaintext from captured hashes using wordlists, rules and brute force.
Where it shines
- hashcat is GPU-fast across a huge range of hash types
- John is flexible and great on CPU or unusual formats
Where it falls down
- You need the right wordlists and rules
- hashcat wants a decent GPU; cracking is time and luck
My take
I keep both. hashcat when I’ve got a GPU and speed matters, John when the format’s odd or I’m on CPU. Each has its strengths.