I'm struggling with creating a mask to brute-force using Hashcat a password of variable length, but with a known suffix.

Say the known suffix is 123$ but the variable-length "prefix" can contain between 4 and 7 characters (i.e. total length 8 to 11 characters)

Do I need to define a charset? I'm aware of "increment mode", but how do I stipulate a variable length mask - looking at examples it seems to only let me define each character independently, how would this work with a variable length?


You won't need to define a charset if your password uses one of the included ones.

You should use a .hcmask file to define your different lengths.

Like this:


There are 96 characters in ?a, so 96⁴ + 96⁵ + 96⁶ + 96⁷ ≈ 2⁴⁶ hash computations are necessary, which would require 10 to 20 minutes at 70 GH/s.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.