Is there a way to find out how long it takes John the Ripper to crack a particular password?

Question

I am looking to test/demonstrate things like: when the supplied wordlist contains "abc123" and pw="abc123" then John cracks the pw in 1/2 a second... but if word list does not contain "abc123" John takes 5000 seconds to crack the pw.

John --test myPwFile does not seem to do what I want it to do.

Answer 1

The important thing to understand is that password cracking time is an average. The attacker will try a lot of passwords, and may be lucky... or not. John the Ripper will use the provided word list, and then try "variants" of the said words, in some order which may or may not be representative of what an attacker will do.

If your password is chosen "at random" (uniformly) in a set of N possible passwords, then the average attack time will be the time it takes to compute N/2 hashes (with whatever hash function is used in your specific situation). This means that if you generate one million such passwords, and each time get the attacker to crack the chosen password, and then sum up all the times taken and divide by one million, then you will find that average times. Sometimes the attacker was faster; sometimes he was slower.

Or, said otherwise: no, John the Ripper is NOT the much fabled "password meter" which will give an absolute "strength value" to your password. The strength of a password is a property of how you generate it, not of the password itself. For any given password, you can only reason on averages and pray for the best.

The whole idea is that a password which is sufficiently random (more correctly, a password which is generated from a sufficiently random process) will bring the probability of an attacker getting lucky sufficiently low to be neglected (if the attacker has only one chance in 14 millions to get the password within one week of computations, then you can even out the chances by buying a lottery ticket, which has one chance in 14 millions to make you rich enough to ignore those trivial matters of stolen passwords).

Answer 2

No.
It is not possible to find the time to crack the password. Because if your password is in the dictionary provided by John The Ripper then it will crack the password very quickly. But if the password is not in the dictionary it will do brute force against the password trying all possible combinations. The brute force timing is proportional to complexity of your password. If the password is not longer having no special characters or numbers then it will not take long time. If you use John The Ripper to crack a password which is complex it will take years in your PC. If the password is very strong with length more than 15 and mixed with special characters and numbers then it don't try to crack. It will take more than your lifetime.