Move beyond wordlists. When you know the password structure, mask attacks let you define exact character patterns. Hybrid attacks combine wordlists with masks for even more power.
-a 3) and built-in charset placeholders-i) to sweep across multiple lengths-1, -2, -3, -4-a 6 and -a 7) combining wordlists with masks-a 3)A mask attack generates candidates based on character position patterns. Instead of reading from a wordlist, Hashcat builds every possible combination matching the mask.
| Placeholder | Character Set | Example Characters |
|---|---|---|
?l | Lowercase letters | a-z |
?u | Uppercase letters | A-Z |
?d | Digits | 0-9 |
?s | Special characters | !@#$%^&*()... |
?a | All printable ASCII | ?l?u?d?s combined |
?b | Full byte range | 0x00-0xff (256 values) |
Each placeholder represents one character position in the candidate password.
Each position in the mask defines what characters are allowed at that position.
Mask: ?d?d?d?d
Generates: 0000 through 9999
Keyspace: 10,000 candidates
Mask: ?u?l?l?l?d?d
Example: Alex42, John99
Keyspace: 26 x 26 x 26 x 26 x 10 x 10 = 45,697,600
Mask: ?a?a?a?a
All printable 4-char passwords
Keyspace: 95^4 = 81,450,625
hashcat -m 0 -a 3 -o results.txt \
hashes.txt ?d?d?d?d-i)When you don't know the exact password length, incremental mode gradually increases the mask length from a minimum to a maximum.
# Try all printable passwords from 4 to 8 characters
hashcat -m 0 -a 3 -i --increment-min 4 --increment-max 8 \
hashes.txt ?a?a?a?a?a?a?a?a--increment-min (default: 1)--increment-max--increment-max?a grows exponentially. At 8 characters that is 95^8 = 6.6 trillion candidates. Use more constrained charsets when possible.When built-in placeholders are too broad or too narrow, define your own charsets with -1 through -4.
# Custom charset 1: lowercase + digits
hashcat -m 0 -a 3 -1 ?l?d hashes.txt ?1?1?1?1?1?1
# Custom charset mixing: uppercase first, then custom
hashcat -m 0 -a 3 -1 ?l?d -2 ?u?s \
hashes.txt ?2?1?1?1?1?d
# Literal characters in a custom charset
hashcat -m 0 -a 3 -1 abc123 hashes.txt ?1?1?1?1-1 <charset> — referenced as ?1-2 <charset> — referenced as ?2-3 <charset> — referenced as ?3-4 <charset> — referenced as ?4You can combine built-in placeholders and literal characters in a single charset definition.
Hybrid attacks combine a wordlist with a mask, covering the common pattern of users appending or prepending characters to dictionary words.
Appends mask characters after each dictionary word.
# password123, summer99, etc.
hashcat -m 0 -a 6 \
hashes.txt rockyou.txt ?d?d?dIf rockyou has "password", generates: password000 through password999
Prepends mask characters before each dictionary word.
# 123password, 42summer, etc.
hashcat -m 0 -a 7 \
hashes.txt ?d?d?d rockyou.txtIf rockyou has "password", generates: 000password through 999password
| Mode | Flag | Source | Best For |
|---|---|---|---|
| Dictionary | -a 0 | Wordlist | Common passwords, leaked lists |
| Combinator | -a 1 | Wordlist + Wordlist | Two-word passwords |
| Mask / Brute-Force | -a 3 | Pattern | Known structure (PINs, patterns) |
| Hybrid (dict+mask) | -a 6 | Wordlist + Pattern | Words with appended chars |
| Hybrid (mask+dict) | -a 7 | Pattern + Wordlist | Words with prepended chars |
Strategy: Start with dictionary (-a 0 + rules), then hybrid (-a 6/-a 7), then targeted masks (-a 3). Full brute-force is a last resort.
hashes.txt with MD5 hashes of known test passwords?d?d?d?d?u?l?l?l?d?d