Command Structure & Parameters

Complete reference for hashcat command-line syntax, flags, and arguments.

General Syntax

Every hashcat invocation follows the same pattern:

hashcat [options...] hash_file [dictionary|mask|dictionary+mask]

The binary name varies by platform:

• Linux / macOS: hashcat (or ./hashcat.bin if running from the extracted directory)
• Windows: hashcat.exe

Options (flags) can appear in any order before or after the hash file, but the positional arguments — hash file, wordlists, and masks — must appear in the correct sequence after all flags.

Hash Type: -m

The -m parameter specifies the hash algorithm hashcat should use for cracking. Using the wrong mode is the most common beginner mistake — hashcat will run but find nothing because it is interpreting the hash bytes incorrectly.

Common Hash Modes

Attack Mode: -a

The -a parameter selects the attack strategy. It determines what kind of arguments (wordlists, masks, or both) must follow the hash file.

Mask Charsets

In mask mode (-a 3), each position in the mask is defined by a charset placeholder:

Output Control

Output File: -o

By default, hashcat displays cracked hashes on screen and stores them in hashcat.potfile. Use -o to write results to a specific file:

hashcat -m 0 -a 0 -o cracked.txt hashes.txt rockyou.txt

Output Format: --outfile-format

Controls what gets written to the output file. The value is a bitmask — add the numbers together to combine fields:

Rules: -r

Rules transform dictionary words on the fly, dramatically expanding the effective wordlist without increasing file size. Each rule defines a mutation (capitalize, reverse, append digits, leet-speak substitution, etc.).

# Single rule file
hashcat -m 0 -a 0 -r rules/best64.rule hashes.txt rockyou.txt

# Multiple rule files (chained — every combination is applied)
hashcat -m 0 -a 0 -r rules/best64.rule -r rules/toggles1.rule hashes.txt rockyou.txt

Incremental Mode: -i

By default, a mask attack only tries candidates matching the exact mask length. The -i (or --increment) flag tells hashcat to iterate through increasing lengths.

# Without increment: only tries 8-character combinations
hashcat -m 0 -a 3 hashes.txt ?a?a?a?a?a?a?a?a

# With increment: tries 1-char, 2-char, ..., up to 8-char
hashcat -m 0 -a 3 -i hashes.txt ?a?a?a?a?a?a?a?a

# With min/max bounds: tries 4-char through 8-char only
hashcat -m 0 -a 3 -i --increment-min 4 --increment-max 8 hashes.txt ?a?a?a?a?a?a?a?a

Workload Profile: -w

The workload profile controls how aggressively hashcat uses the GPU. Higher values yield faster cracking but may cause system unresponsiveness.

Device Selection: -D

By default, hashcat auto-detects available compute devices. Use -D to restrict to specific device types:

• -D 1 — CPU only
• -D 2 — GPU only
• -D 1,2 — Both CPU and GPU

Use -I (or --backend-info) to list all detected devices and their capabilities before choosing.

Session Management

Long-running attacks can be paused and resumed using sessions.

# Start a named session
hashcat --session audit_q1 -m 1000 -a 0 hashes.txt rockyou.txt

# Pause: press 'c' during execution (checkpoint), or 'q' to quit gracefully

# Resume the session later
hashcat --session audit_q1 --restore

Session data is stored in *.restore and *.induct files in the hashcat working directory. Without --session, hashcat uses a default session name and will refuse to start a second instance.

Complete Command Examples

Example 1: Simple MD5 dictionary attack

hashcat -m 0 -a 0 -o results.txt hashes.txt rockyou.txt

Cracks MD5 hashes using the RockYou wordlist. Results written as hash:password pairs to results.txt.

Example 2: NTLM mask attack with incremental mode

hashcat -m 1000 -a 3 -o results.txt --session mysession \
  --increment --increment-min 4 --increment-max 8 \
  -w 3 hashes.txt ?a?a?a?a?a?a?a?a

Cracks NTLM hashes using a brute-force mask attack. Tries all printable character combinations from 4 to 8 characters. Uses high workload on GPU. Named session allows pause/resume.

Example 3: Dictionary + rules attack on SHA-512

hashcat -m 1800 -a 0 -r rules/best64.rule -o cracked.txt \
  -w 2 shadow_hashes.txt rockyou.txt

Cracks Linux shadow file hashes (sha512crypt) using a dictionary with the best64 rule file applied to each word.

Example 4: Hybrid dictionary + mask

hashcat -m 0 -a 6 -o results.txt hashes.txt rockyou.txt ?d?d?d?d

Appends 4 digits to every word in the dictionary. Catches patterns like password2024 or admin1234.

Example 5: Combinator attack

hashcat -m 0 -a 1 -o results.txt hashes.txt words1.txt words2.txt

Concatenates every word from words1.txt with every word from words2.txt. Effective for compound passwords.

Quick Reference Card

Further Reading

• Hashcat Wiki — official documentation and hash mode reference
• Mask Attack Reference — detailed mask charset documentation
• Rule-Based Attack Reference — rule syntax and examples
• hashcat --help — the built-in help is comprehensive and always up to date