I know of mask and dictionary attacks.

Using a mask attack, I specify the charset for each position in the password pattern, e.g., ?1?1?d?1?d?1?1?d, where ?1 := ?l?u?s.

But how do I tell hashcat to only hash (fixed length) passwords with at least N digits (?d)? That is, the ?d charset specifiers may float around in the pattern above.

1 Answer 1


There's no native way to do this with hashcat. Instead, you must generate a list of masks that contain all of the permutations that fit your criteria.

The common tool for this is policygen from the PACK toolkit. My answer here outlines how to use it.

For your use case, it would be something like this (assuming 8-character passwords and a minimum of 3 digits):

$ policygen --minlength=8 --maxlength=8  --mindigit=3 \
    -o len8mindigit3.masks

     PolicyGen 0.0.2  | |
      _ __   __ _  ___| | _
     | '_ \ / _` |/ __| |/ /
     | |_) | (_| | (__|   < 
     | .__/ \__,_|\___|_|\_\
     | |                    
     |_| [email protected]

[*] Saving generated masks to [len8mindigit3.masks]
[*] Using 1,000,000,000 keys/sec for calculations.
[*] Password policy:
    Pass Lengths: min:8 max:8
    Min strength: l:None u:None d:3 s:None
    Max strength: l:None u:None d:None s:None
[*] Generating [compliant] masks.
[*] Generating 8 character password masks.
[*] Total Masks:  65536 Time: 76 days, 18:50:04
[*] Policy Masks: 21067 Time: 3 days, 8:11:03

$ head len8mindigit3.masks

$ tail len8mindigit3.masks

You would then supply that file of masks to hashcat.

  • Thank you - do you know if John the Ripper supports floating charset specifiers?
    – Shuzheng
    Jul 6, 2018 at 4:24
  • I think JtR has the same capability. Jul 6, 2018 at 4:33
  • I meant if JtR supports floating charset specifiers instead of multiple masks? I will definitely try out Pack :) Do multiple masks provide huge overhead on the hashcat engine? That is, does switching masks take “long” time?
    – Shuzheng
    Jul 6, 2018 at 4:38
  • I meant that JtR and hashcat are the same - JtR also does not support such floating specifiers as far as I am aware. And on hashcat, there is a small performance cost - a second or two between each mask. so if your results are large, compressing them to use only a non-digit charset (?l?u?s) may be somewhat more efficient. Jul 6, 2018 at 6:25
  • I am not sure what you mean by compressing. Would you instead of specifying at least one of ?l, ?u, and ?s, say that the candidates much contain at least three -1 ?l?u?s..? I cannot see Pack supports this?
    – Shuzheng
    Jul 6, 2018 at 7:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .