Hashcat Rule Builder
Build rules visually, preview against test words, download as .rule or John .conf.
Hashcat rules are transformation functions applied to every word in a wordlist during a password cracking attack. Chain multiple functions — lowercase, append a number, replace characters — to generate thousands of variations without storing them. Works with Hashcat (-a 0 -r) and John the Ripper (--rules).
What are Hashcat rules?
Hashcat rules are single-line instructions that transform plaintext password candidates before hashing them. Each rule consists of one or more functions — for example l to lowercase everything, $1 to append the digit 1, or sa@ to replace every "a" with "@". Rules are applied to every word in a wordlist, letting a small list of base words expand into millions of realistic password guesses.
Rule-based attacks in CTF and pentesting
In CTF competitions and authorised penetration tests, rule-based attacks are often the fastest path to cracking hashed credentials. Leaked password databases show that users follow predictable patterns: capitalise the first letter, append a year, swap letters for numbers. A well-crafted ruleset encodes these patterns and recovers passwords that a plain dictionary attack would miss entirely.
How this tool works
Select a transformation function from the dropdown, fill in any required parameters (position, character), and click Add Step to append it to a rule chain. Each chain becomes one line in the output .rule file. The Preview button applies every chain to your test wordlist so you can verify the output before downloading. The tool supports all standard John the Ripper-compatible functions as well as several Hashcat-specific ones.