


The "wikipedia-wordlist-sraveau-20090325" file is used as reference wordlist. Performance of the wordlist key-provider is tested to find which compressed wordlist formats are best using 1000 NTLM hashes with and without rules support. More detailed performance data can be viewed here. Note: Except for SHA256CRYPT and SHA512CRYPT, an older non-AVX2 build of John the Ripper is benchmarked here a newer AVX2 build would be up to twice faster at some of the hash types. Note: John the Ripper's multi-threading support is inefficient for fast hashes (all of those benchmarked here except for DCC2, MD5CRYPT, BCRYPT, SHA256CRYPT, SHA512CRYPT, WPA-PSK), so its performance for 4 threads is not much greater than for 1 thread much better cumulative performance of 4 processes (rather than threads) may be achieved by using -fork=4 instead. Other programs use a dumb mode for brute-force.

Note: John the Ripper uses a smart mode that tries more probable candidate passwords first. Note: Hash Suite and Hashcat can treat the CPU as an OpenCL device (providing in many cases better performance), but unlike other CPU programs benchmarked here, it would require an OpenCL driver. Note: Demo version of PPA only permits 10 accounts. Results for salted hashes (where said multiplication was applied) are marked with asterisks (*). For salted hashes (DCC, DCC2, SSHA, MD5CRYPT, BCRYPT, SHA256CRYPT, SHA512CRYPT, WPA-PSK), this is the number of candidate passwords tested per second multiplied by the number of hashes (all of which use different salts in these benchmarks). For non-salted hashes (LM, NTLM, MD5, SHA1, SHA256, SHA512), this is the same as candidate passwords tested per second. Performance is reported in hashes computed per second. The programs are sorted by average performance in first 4 columns. Hash Suite 3.5 database file with 1 million NTLM hashes and 1 million LM hashes: 80MBĪll hashes were randomly generated.
