About
hashcat tests candidate values against a list of hashes to see which it can recover. That shows how weak the underlying secrets are. Use it only on hashes from systems you own or have written permission to test.
Install it
pkg install hashcat
Run this inside Termux. If the package is already present, pkg will say so and
do nothing.
Commands worth knowing
6 of the invocations you will actually reach for. Tap the copy button to put one on your clipboard.
hashcat -m 0 -a 0 hashes.txt wordlist.txt Test a list of MD5 digests against a wordlist. Shows how weak the secrets behind them are, on hashes you own or are authorised to audit. hashcat -m 1000 -a 0 ntlm.txt wordlist.txt Run the same check against Windows NTLM hashes taken from a system you are allowed to test. hashcat -m 0 -a 3 hashes.txt ?a?a?a?a Try every four-character combination. Useful for short values a wordlist would miss. hashcat --show hashes.txt Print any digests already recovered in earlier runs alongside their plaintext. hashcat -m 1800 -a 0 sha512.txt wordlist.txt Audit SHA-512 digests with a dictionary attack to gauge the strength of a policy. hashcat -b Benchmark the device. See how many candidates per second to expect. Worked example
Run hashcat -m 0 -a 0 hashes.txt wordlist.txt and this is what you should see.
$ hashcat -m 0 -a 0 hashes.txt wordlist.txt
Hash.Mode........: 0 (MD5)
Recovered........: 3/10
Progress.........: 14344385/14344385
Status...........: Exhausted
Time.Started.....: Sat Oct 24 10:00:00 2026 Developed by
Jens Steube (atom) and the hashcat project · released under MIT.