John the Ripper is an offline password cracker that supports hundreds of hash and cipher types and runs across many operating systems and hardware platforms including CPUs, GPUs, and FPGAs.
The tool addresses the need to detect weak passwords and verify password security by attempting to crack hashes through multiple attack modes. It works by accepting password files and applying configurable cracking strategies, including dictionary attacks with word mangling rules, brute force approaches, and incremental modes. Cracked passwords are saved to a pot file to avoid redundant work across sessions, and the tool can save and restore its state to permit recovery from interruptions.
The jumbo version suits security professionals and system administrators who need to audit password strength across Unix, macOS, Windows, and other platforms. It is particularly valuable when you need support for a wide variety of hash types beyond standard crypt formats, including Kerberos, Windows LM hashes, and hundreds of additional cipher types. The jumbo variant prioritizes breadth of functionality over maturity, making it appropriate when you need to handle unusual or legacy hash formats but should expect that some code paths may contain bugs. The tool supports acceleration through multiple CPUs, GPU compute via OpenCL, and SIMD instructions, allowing you to scale cracking performance to available hardware.
The project accepts community contributions through pull requests with relatively low quality barriers, which has resulted in extensive functionality being added beyond the core release. Automated testing has been introduced for contributions, indicating a shift toward more rigorous validation. The codebase is written primarily in C with assembly language optimizations, reflecting its focus on performance-critical password cracking operations.
