During password auditing, I found the pepper key used along the salt during password hashing. I want to know how can I crack it using hashcat/oclhashcat?

As far as I can tell, this are the following format hashcat support:

  • sha256($pass.$salt)
  • sha256($salt.$pass)

What I will like to have are:

  • sha256($pass.$salt.**$pepper**)
  • sha256($salt.$pass.**$pepper**)

1 Answer 1


Assuming that the pepper is the same for all passwords, you can use a hybrid attack with a dictionary and a static mask (consisting of the pepper) to cover the second case. Alternatively, you could use a mask attack with a mask ending in the static characters of the pepper.

For the first case, just add the pepper to the input file such that


turns into


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.