John the Ripper can demonstrate how easy it is to reveal weak passwords (and the seemingly more sophisticated ones) using a leaked database and a free tool. Pen-testing distributions such as Kali Linux and Parrot OS usually include the full package, so you won’t need additional installations. You can then use these hashes as input to find the password with John the Ripper.

kbdx files with keepass2john, and password-protected zip archives with zip2john. This open-source package is free to download and has several modules for generating hashes from a range of file types, such as Secure Shell (SSH) keys with ssh2john. It’s often what pen-testers and ethical hackers use to find the true passwords behind hashes. John the Ripper is a popular password cracking tool that can be used to perform brute-force attacks using different encryption technologies and helpful wordlists. We may make money when you click on links to our partners. ESecurity Planet content and product recommendations are editorially independent.