Advanced Forensic Guide

Mastering Hash Extraction

Recover passwords without uploading your files. Learn how to extract the cryptographic fingerprint (hash) from your protected documents and archives for maximum privacy and speed.

100% Privacy

File content stays with you

Instant Upload

Hashes are tiny text strings

Cross-Platform

Windows, Linux, macOS

Forensic Standard

Compatible with Hashcat

Local extractor for large or private files

Extract the recovery hash on your own device. The original file never leaves your computer; send only the small hash to start Fast Check.

Download Catpasswd

1Choose the fileOpen Catpasswd and select the locked document or archive.
2Export the hashSave the complete `.hash` output, without editing or truncating it.
3Submit belowPaste or attach the hash and start Fast Check with your email.

Use a complete recovery hash ($rar5$, $pdf$, $office$, etc.), not an MD5/SHA checksum. Hash-only Fast Check returns a password only; it cannot preview or unlock the original file.

Submit a recovery hash

Paste a complete recovery hash from Catpasswd Hash Extract or a *2john-compatible tool, or upload its small .txt/.hash file. Modern PDF (128/256-bit), RAR3/RAR5 and Office 2007+ hashes can start a password-only Fast Check; ZIP, 7z and legacy 40-bit formats still require the original file for safe verification. Download the local extractor.

Why Extract a Hash?

A hash is a cryptographic signature derived from your password and the file's encryption metadata. It acts as a "checksum" for the password.

The Golden Rule of ForensicsFor supported formats, a recovery hash contains the data needed to test passwords without transferring the original file. This is ideal for sensitive documents and massive archives. Keep the original file safely: direct hash jobs are password-only and cannot decrypt or preview it.

Extraction Tools Reference

John the Ripper / Hashcat

Recommended path: use the local Catpasswd extractor above. The standard *2john utilities remain available as an advanced/manual alternative.

Office Documents

DOCX, XLSX, PPTX

office2john.py

$ python office2john.py protected_doc.docx > hash.txt

Output Example:$office$*2013*100000*256*...

Requires Python installed. Works on all modern Office XML formats.

ZIP Archives

ZIP, ZIPX

zip2john

$ zip2john protected_archive.zip > hash.txt

Output Example:$pkzip2$1*1*2*0*...

Extracts hashes from legacy and AES-encrypted ZIP files.

RAR Archives

RAR, RAR5

rar2john

$ rar2john protected_archive.rar > hash.txt

Output Example:$rar5$16*...

Supports both RAR3 and new RAR5 header encryption.

PDF Documents

PDF

pdf2john.pl

$ perl pdf2john.pl secure_doc.pdf > hash.txt

Output Example:$pdf$2*105*...

Requires Perl. Supports standard 40-bit to 256-bit AES encryption.

Universal Process

Download the local extractor

Start with Catpasswd Hash Extract for a guided, private workflow. Use John the Ripper or Hashcat binaries only when you need a manual fallback.

Extract a complete hash

Choose the protected file in Catpasswd and export the full `.hash` line. Keep the original file on your device.

Submit the hash

Copy the complete output line (starting with $pdf$, $rar$, $office$, etc.) and paste it into Fast Check.

Have your hash?

Direct hash submission is available for PDF, RAR and modern Office hashes.

Supported Formats

PDF 1.7+

RAR3 / RAR5

Office 2007+

Direct hash jobs currently accept modern PDF (128/256-bit), RAR3/RAR5 and Office 2007+ formats. ZIP, 7z and legacy 40-bit formats stay on the original-file path so the final password can be independently verified.

Submit Hash Now

Fast Check starts immediately after submission

Pro Tip

If you have a large archive (e.g. 50GB backup), extracting the hash is the only way to recover it efficiently. Uploading 50GB takes hours; uploading a hash takes milliseconds.