Free John the Ripper conversion

Free file hash extractor

Use the file hash extractor to convert supported encrypted documents and archives into recovery hashes without keeping the original uploaded file.

Recovery material

Extract a Hashcat-ready recovery hash

The server uses John the Ripper conversion tools. Your original file is deleted as soon as extraction finishes.

+Choose an Office, PDF or archive fileMaximum 3 MB · DOC(X), XLS(X), PPT(X), PDF, RAR, ZIP or 7zI own this file or have authorization to recover it.

Use the extracted hash

Try common passwords locally or expand the hash search

The desktop app can test the free common-password dictionary locally. GPU cloud adds larger dictionaries, numeric masks and combination modes.

Download the desktop app Compare GPU cloud plans

Conversion before recovery

Extract recovery material without uploading the file to a cracking queue

Password-recovery tools do not test candidates directly against a DOCX, PDF or archive file. A file hash extractor first converts the encrypted structure into a recovery hash that Hashcat or John the Ripper can evaluate offline.

This free file hash extractor supports Office documents, PDF, ZIP, RAR and 7z. The Office hash extractor uses office2john, while the PDF hash extractor uses pdf2john. The file hash extractor returns the detected format, a suggested Hashcat mode when the format can be mapped safely, and the extracted hash. It does not reveal or recover the original password.

Practical guide

How the file hash extractor prepares supported formats

Supported converters

Formats supported by the file hash extractor

The file hash extractor selects a John the Ripper converter based on the verified file signature, not only the filename extension. Files without supported encryption return no recovery hash.

File type	Extraction tool	Typical Hashcat mode
Office 2007 / 2010 / 2013+	office2john.py	9400 / 9500 / 9600
Encrypted PDF	pdf2john.pl	10400–10700 by PDF revision
Encrypted ZIP	zip2john	13600 or 17200 by ZIP format
RAR3 / RAR5	rar2john	12500 / 13000
7-Zip	7z2john.pl	11600 when the compression type is supported

Reading the result

The extracted hash is not the password

A recovery hash contains parameters and encrypted verification data needed to test password candidates. It normally starts with a recognizable marker such as $office$, $pdf$, $rar5$, $pkzip$ or $7z$.

Treat the hash as sensitive recovery material. Anyone who receives it may be able to test guesses offline, so do not post it publicly or include it in support screenshots.

$office$*2007* maps to mode 9400.
$office$*2010* maps to mode 9500.
$office$*2013* is used by Office 2013 and later formats and maps to mode 9600.
PDF and archive modes depend on the exact encryption revision reported by the converter.

When extraction returns nothing

Not every protected-looking file has an open-password hash

An XLSX sheetProtection setting or PDF permission restriction may limit editing without requiring an opening password. Those cases should be handled by a restriction remover rather than a hash recovery workflow.

Extraction can also fail when the file is damaged, the extension does not match its signature, or a 7z compression method is not supported by the configured Hashcat mode.

Upload handling

One daily extraction, 3 MB maximum, immediate deletion

The public extractor is limited by device and IP to reduce automated abuse. Files are accepted only after an ownership or authorization confirmation, written to a temporary path, converted, and deleted before the API response is returned.

Use the desktop application when the file is larger than 3 MB or when supported local extraction is preferable. The desktop free workflow can test the common-password dictionary locally after extraction.

Questions about this tool

Frequently asked questions

Does the file hash extractor crack the file password?

No. The file hash extractor only prepares encrypted verification data for candidate testing. Finding a password still depends on whether the correct candidate is included in the selected dictionary, mask or rules.

Which Office Hashcat mode should I use?

The Office hash extractor maps Office 2007 hashes to mode 9400, Office 2010 to 9500, and hashes beginning with the Office 2013 marker to 9600.

Why did the Office hash extractor find no hash?

The file may not have an opening password. Worksheet, workbook and editing restrictions are different protection types and can often be removed without password recovery.

Are PDF owner-password permissions returned as an opening-password hash?

Use the protection analyzer before the PDF hash extractor. If a PDF opens without a user password and only limits printing, copying or editing, direct permission removal is the appropriate path.

Is the extracted hash safe to share?

No. A recovery hash does not reveal the password directly, but it allows offline candidate testing. Store it as sensitive recovery material.

Is my original file retained after extraction?

No. The web endpoint uses a temporary file and deletes it before returning the hash. The response is marked no-store.

Why can a 7z hash be rejected?

Some 7z compression methods are not supported by Hashcat mode 11600. The extractor rejects known unsupported types instead of returning a hash that the recovery worker cannot process.