Let's say I have a couple of hashes that I need to bruteforce as dictionary attack didn't work. Is there a way I can tell hashcat to start from a specific password length so it won't waste resources on looking for results that won't work?

  • 1
    You mean --pw-min? If so, you will find this option in the command line help, in the manual, and in various places online.
    – schroeder
    Jun 11, 2018 at 20:37
  • 1
    --pw-min and --pw-max were replaced some time ago with --increment-min and --increment-max. But this information is indeed readily available. Jun 13, 2018 at 5:05

1 Answer 1


Sounds like you're looking for --increment-min. This will start a bruteforce/mask attack at a minimum length.

For example, this will try digits-only candidates, starting with length 7:

hashcat -a 3 -m [hashtype] -i --increment-min=7 targethashes.list ?d?d?d?d?d?d?d?d?d?d

You didn't directly ask this, but the deeper intent of your question appears to be "what can I do beyond a dictionary attack?"

There are many other options to try before you go full bruteforce - combinator, hybrid, masks. See hashcat's core attack modes for some introductory materials.

  • I know that there are more, however none of them work - apparently a random password generator has been used. Jun 14, 2018 at 10:38
  • You'd have to do a lot of work to rule out many other methods before you can even tentatively start to conclude that. The more methods you try, the more likely you are to be right, though. :) Jun 14, 2018 at 13:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .