Hashcat is a free password recovery program that hands most of its work to the graphics card. Its lead developer, known by the handle atom, announced on 4 December 2015 on the project forum that the code of hashcat and its GPU counterpart, oclHashcat, was being released under the MIT licence. The two programs were later merged into one, starting with version 3.00.
The project is still active. Version 7.1.2, released on 23 August 2025 according to the GitHub repository, is the latest build offered for download, and the change log already describes what is coming next.
What Hashcat is for
A well-designed service never keeps passwords in plain text in its database. It stores a fingerprint, called a hash, produced by a one-way mathematical function. During a security audit the administrator has only that fingerprint to work with, and Hashcat is the tool that checks, within an authorised scope, how strong the password behind it really is. According to its documentation it handles more than four hundred and fifty families of hashes, from the formats used by operating systems to those of encrypted archives and database managers.
What sets Hashcat apart is its reliance on the graphics card. Work of this kind parallelises very well, and a modern graphics processor gets through it far faster than a central processor. The program runs on NVIDIA, AMD and Intel cards as well as on ordinary CPUs, and it can spread the load across several devices at once. It includes a rule engine that runs on the card itself, a benchmark for measuring performance, a thermal watchdog and a restore feature that lets a session be paused and resumed.
Version 7, released in 2025, was a turning point. It adds a Metal backend that brings support for Apple silicon Macs, a feature named the Assimilation Bridge and a Python plugin that lets developers write their own matching logic without recompiling, along with a set of tools for extracting hashes from various sources. In our software library Hashcat sits among the defensive audit instruments, alongside tools such as Volatility for memory analysis and YARA for file identification.
The line between Hashcat and other security tools is clear. It does not go after an online service and does not guess a password from a username alone. It works only on hashes already obtained elsewhere, which makes it a laboratory tool rather than a means of remote access. The project documentation is explicit on this point.
Who is it for?
Hashcat is aimed at security professionals working within a defined scope: contracted penetration testers, red and blue teams, digital forensics analysts who have to open an encrypted device under legal authority, and administrators checking that their organisation’s passwords would withstand a recovery attempt. Cryptography researchers also use it to assess how resistant a hash function is.
Its limits frame that use. The program is command-line only, with no graphical interface, and it needs suitable hardware together with the right drivers for each card vendor, which makes the first setup more demanding than an ordinary application. Above all, it must only be run on hashes you are legally entitled to hold. The documentation points out that it cannot break into an online account, even with the account owner’s consent, and that using it without authorisation carries serious consequences.
Download Hashcat safely
The download page on hashcat.net provides the binary archive of the latest version for Windows and Linux, the source code, and for every file a PGP signature so its authenticity can be checked against the project’s public key. On macOS the archive contains no executable, and the publisher points instead to building from source or using a package manager. The code is also on the hashcat/hashcat repository on GitHub. The software is entirely free and has no paid edition.
A password recovery tool is a prime target for malware, because it often runs with broad privileges on an analysis machine. An executable picked up on a forum or a general download site offers no guarantee at all. Verifying the PGP signature the project publishes before running the program is the only safe way to be sure it has not been tampered with.
Frequently asked questions
Is Hashcat free?
Yes. Hashcat is free software released under the MIT licence since December 2015, with no paid edition. The source code and the binaries can be downloaded freely from hashcat.net and from GitHub.
Do you need a graphics card to use Hashcat?
No, the tool also runs on an ordinary CPU, but it is built to take advantage of graphics cards, which are far faster at this kind of work. The card vendor’s drivers have to be installed first.
Can Hashcat recover the password of an online account?
No. Hashcat works only on hashes already in your possession and does not attack a remote service. Its documentation states that it is not meant to break into an online account and must be used within an authorised scope.
