How to run John the Ripper yourself — the complete walkthrough.

When does John the Ripper make sense?

Short version — pick John for exactly these cases:

• Monero (.keys file). The monero2john.py script extracts a crackable hash, and John’s Monero format is the documented specialist path. No other mainstream tool handles it out of the box — the dedicated Monero guide covers file locations, speeds and the seed-first route.
• Learning the craft. John’s wordlist + rules model is the simplest way to understand how password cracking actually works before you touch GPU tools.
• Non-wallet encrypted files you also own — SSH keys, GnuPG keys, ZIP and PDF files. If your wallet password is stored behind another password, John can open that door.

And when to skip it: wallet.dat, Electrum and BIP38 are better served by btcrecover’s token lists (it reads those files directly), and pure GPU speed for masks belongs to hashcat. John is the specialist and the teacher, not the default workhorse. If you’re not sure which tool fits, start with the tool comparison.

The walkthrough — six steps

1. 1

   Protect the file (same rules as always)

   Work on a read-only copy, offline or on a clean machine, downloads only from official sources. The protection rules, plus the printable offline toolkit that keeps every step on paper.

2. 2

   Install the jumbo build

   You want the community “jumbo” edition — the core release alone does not include the wallet formats or the extraction scripts. Get it from the official source: Openwall’s prebuilt jumbo releases or a source build. Note that Debian/Ubuntu’s john package is the core build and does not include the wallet formats or the *2john.py scripts, so sudo apt install john is not enough for this guide:

   # macOS (Homebrew) brew install john-jumbo

   On Windows, download the official prebuilt jumbo archive from Openwall and run john.exe from the run folder. Verify the install — and that you have the jumbo formats and the *2john.py scripts — with:

   john --version john --list=formats | grep -i -E "monero|ethereum|bitcoin|electrum" ls run/*2john.py

   If Monero and the wallet formats appear and the scripts are present, you have the right build. Only the official downloads — never a random “John the Ripper cracker” binary from a tutorial site.

3. 3

   Convert your wallet to a hash line

   John works on a one-line “hash” extracted from your wallet — never the whole file. The *2john.py scripts live in the same run folder as John and do that extraction for you:

   Wallet format	Extraction script	Notes
   Monero (.keys)	monero2john.py	John’s best-known wallet format — works on the modern .keys file. The seed — 25-word legacy, 16-word Polyseed, 13-word MyMonero — restores the wallet without the password, so only bother if you lost the seed too. Full Monero guide →
   Ethereum keystore (UTC--…json)	ethereum2john.py	Supports both PBKDF2 and scrypt keystores; the script picks the right parameters from the JSON.
   wallet.dat family (Bitcoin Core, forks)	bitcoin2john.py	Works, but btcrecover’s token lists are usually the better weapon for these — see below.
   Electrum	electrum2john.py	Same story — supported, but btcrecover reads Electrum files directly with fewer moving parts.
   MultiBit (Classic .key / .wallet, HD)	multibit2john.py	Extracts all MultiBit variants. The Classic .key format is extremely fast to test; btcrecover and hashcat also read it directly.
   Coinomi (scrypt vault)	coinomi2john.py	Outputs the same $multibit$ hash format — btcrecover reads the vault directly and is the usual first choice.
   Blockchain.com (.aes.json)	blockchain2john.py	Supported, but the hashcat modes (12700 / 15200 / 18800) and btcrecover both cover this wallet too.
   Keplr (Cosmos extension vault)	keplr2john.py	Extracts the password-encrypted vault from the browser extension’s LevelDB storage for the legacy extension format. Keplr v2/current vaults use a changed format — identify the version before assuming this script works.
   Cardano (legacy Daedalus secret.key)	cardano2john.py	For 2017–2019 Daedalus wallets. Modern Cardano wallets restore from the seed phrase instead — this password only protects the legacy key file.
   BitShares (light-client wallet database)	bitshares2john.py	Reads the wallet database used by the BitShares 2 light client and wallet.bitshares.org.
   Tezos ICO / fundraiser (15-word mnemonic, fundraiser email, tz1 address)	tezos2john.py	The ICO/fundraiser password route — not a generic extractor for password-protected Tezos client key files.

   For a Monero .keys file:

   python monero2john.py wallet.keys > monero.hash

   Then take a look — the line starts with $monero$…, which tells John which format to use. Most *2john.py scripts also accept multiple files at once, so you can extract several candidates in one go.

4. 4

   Pick the attack: wordlist, mask or incremental

   Wordlist with rules — your password hint list plus John’s built-in rule sets that mangle every word (append years, digits, symbols, case flips). The hint-list guide includes a practice demo and a downloadable offline builder that outputs words.txt directly:

   john --wordlist=words.txt --rules=All monero.hash

   Mask — when you remember the shape of the password (“capital letter, five lowercase, two digits”):

   john --mask='?u?l?l?l?l?l?d?d' monero.hash

   John uses the same mask characters as hashcat: ?l lowercase · ?u uppercase · ?d digit · ?s symbol · ?a anything. Incremental — for short, purely random-looking passwords with no clues at all; John’s built-in character-frequency model tries likely patterns first:

   john --incremental monero.hash

   The wordlist is where the case is won or lost — build it from memory, not from a generic list.

5. 5

   Run it and watch the status

   John auto-detects the format from the hash prefix and shows a live status screen — guesses per second, progress and time. You can pause with Ctrl+C and resume later with john --restore. To force a specific format (rarely needed, but useful when a line is ambiguous):

   john --format=monero monero.hash

   Check the full list of supported formats any time with john --list=formats.

   Two tips for long runs. Use more of your CPU with john --fork=4 monero.hash — the work splits across four cores (raise the number up to your core count). And name the session so pause and resume are clean: start with john --session=wallet1 --wordlist=words.txt --rules=All monero.hash, stop any time with Ctrl+C, and resume exactly where you left off with john --restore=wallet1.

   One more attack shape. John’s masks accept the wordlist as a placeholder: john --mask='?w?d?d' --wordlist=words.txt monero.hash tries every word followed by two digits — the hybrid you’d otherwise build with two separate runs.

6. 6

   Read the result — and know when to stop

   Cracked passwords go to John’s potfile (stored per user, typically ~/.john/john.pot). Re-read them any time:

   john --show monero.hash

   If the status screen shows an unworkable pace and no crack after a reasonable run, the real answer is that your candidates are wrong or the case isn’t viable — check the math before investing weeks. Widening a list built from real memory beats letting a GPU run blind.

Password found — now what?

A John the Ripper success means the hash cracked and the wallet opens — the work isn’t done until the funds are safe. Do these in order:

1. 1
   Verify before you move anything. Open the wallet with the recovered password and confirm it loads with the expected addresses and balance before moving funds. (A wrong variant opening a different, empty wallet is a seed-passphrase phenomenon, not a verified encrypted-wallet password — see the passphrase guide.)
2. 2
   Store the password safely. The moment it works, save it in a password manager and keep one written fallback — then never reuse it for another wallet. That is the whole storage rule.
3. 3
   Note the balance first. Write down the balance and addresses before transferring, so you can spot problems immediately.
4. 4
   Move the funds to a fresh wallet. Old wallet software is discontinued and often unsafe to keep using — and importing old keys into modern software does not make them fresh. Create a new wallet with a new seed, back it up and verify it, then send/sweep the funds to its addresses.
5. 5
   Use only official software. The moment you have access is also the moment you are most careless — download wallets only from official sites, never from search ads or links in messages.

Once the wallet is open, make sure this never happens twice — never losing access prevents round two.

Frequently asked questions

Sources & references

1. John the Ripper — official site (downloads, jumbo builds, documentation)
2. openwall/john — source code & *2john extraction scripts (run directory)