Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am looking to test/demonstrate things like: when the supplied wordlist contains "abc123" and pw="abc123" then John cracks the pw in 1/2 a second... but if word list does not contain "abc123" John takes 5000 seconds to crack the pw.

John --test myPwFile does not seem to do what I want it to do.

share|improve this question
up vote 5 down vote accepted

The important thing to understand is that password cracking time is an average. The attacker will try a lot of passwords, and may be lucky... or not. John the Ripper will use the provided word list, and then try "variants" of the said words, in some order which may or may not be representative of what an attacker will do.

If your password is chosen "at random" (uniformly) in a set of N possible passwords, then the average attack time will be the time it takes to compute N/2 hashes (with whatever hash function is used in your specific situation). This means that if you generate one million such passwords, and each time get the attacker to crack the chosen password, and then sum up all the times taken and divide by one million, then you will find that average times. Sometimes the attacker was faster; sometimes he was slower.

Or, said otherwise: no, John the Ripper is NOT the much fabled "password meter" which will give an absolute "strength value" to your password. The strength of a password is a property of how you generate it, not of the password itself. For any given password, you can only reason on averages and pray for the best.

The whole idea is that a password which is sufficiently random (more correctly, a password which is generated from a sufficiently random process) will bring the probability of an attacker getting lucky sufficiently low to be neglected (if the attacker has only one chance in 14 millions to get the password within one week of computations, then you can even out the chances by buying a lottery ticket, which has one chance in 14 millions to make you rich enough to ignore those trivial matters of stolen passwords).

share|improve this answer
great answer. thank you! – bernie2436 Feb 3 '13 at 13:51

It is not possible to find the time to crack the password. Because if your password is in the dictionary provided by John The Ripper then it will crack the password very quickly. But if the password is not in the dictionary it will do brute force against the password trying all possible combinations. The brute force timing is proportional to complexity of your password. If the password is not longer having no special characters or numbers then it will not take long time. If you use John The Ripper to crack a password which is complex it will take years in your PC. If the password is very strong with length more than 15 and mixed with special characters and numbers then it don't try to crack. It will take more than your lifetime.

share|improve this answer
It may take longer than your lifetime. It may be the first password tried. . . – Rory Alsop Feb 3 '13 at 7:18
@RoryAlsop you mean we can crack all passwords quickly? – sujeesh Feb 3 '13 at 8:19
No. Some will be cracked fast, some slow. Depends on the order and config of your cracker. – Rory Alsop Feb 3 '13 at 9:19
@RoryAlsop can you tell me how much time it will take to crack a password having length of 20 characters with 5 numbers, 5 special character, 5 lowercase characters and 5 uppercase character using JTR in a computer having i5 processor? – sujeesh Feb 3 '13 at 10:03
@sujeesh what hash type? that could give you an approximate value if you figure out the number of possible comparisons. then it just depends on the order it goes through them. – Amelia Feb 3 '13 at 10:57

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.