Advanced Forensic Guide

Mastering Hash Extraction

Recover passwords without uploading your files. Learn how to extract the cryptographic fingerprint (hash) from your protected documents and archives for maximum privacy and speed.

100% Privacy

File content stays with you

Instant Upload

Hashes are tiny text strings

Cross-Platform

Windows, Linux, macOS

Forensic Standard

Compatible with Hashcat

Submit a recovery hash

Paste one hash from a *2john tool, or upload its small .txt file. PDF, RAR and modern Office hashes create a normal Free Check job; your original file stays on your device.

Why Extract a Hash?

A hash is a cryptographic signature derived from your password and the file's encryption metadata. It acts as a "checksum" for the password.

The Golden Rule of ForensicsFor supported formats, a recovery hash contains the data needed to test passwords without transferring the original file. This is ideal for sensitive documents and massive archives. Keep the original file safely: direct hash jobs are password-only and cannot decrypt or preview it.

Extraction Tools Reference

John the Ripper / Hashcat

We recommend using the standard *2john utilities.

Office Documents

DOCX, XLSX, PPTX

office2john.py

$ python office2john.py protected_doc.docx > hash.txt

Output Example:$office$*2013*100000*256*...

Requires Python installed. Works on all modern Office XML formats.

ZIP Archives

ZIP, ZIPX

zip2john

$ zip2john protected_archive.zip > hash.txt

Output Example:$pkzip2$1*1*2*0*...

Extracts hashes from legacy and AES-encrypted ZIP files.

RAR Archives

RAR, RAR5

rar2john

$ rar2john protected_archive.rar > hash.txt

Output Example:$rar5$16*...

Supports both RAR3 and new RAR5 header encryption.

PDF Documents

PDF

pdf2john.pl

$ perl pdf2john.pl secure_doc.pdf > hash.txt

Output Example:$pdf$2*105*...

Requires Perl. Supports standard 40-bit to 256-bit AES encryption.

Universal Process

Download Tools

Get the "Jumbo" version of John the Ripper from OpenWall or Hashcat binaries.

Run Command

Open your terminal/command prompt, navigate to the tool folder, and run the extraction command.

Upload Hash

Copy the output string (starting with $zip, $rar, etc.) and paste it into our recovery tool.

Have your hash?

Direct hash submission is available for PDF, RAR and modern Office hashes.

Supported Formats

PDF 1.7+

RAR3 / RAR5

Office 2007+

Submit Hash Now

Average recovery time: ~2 hours

Pro Tip

If you have a large archive (e.g. 50GB backup), extracting the hash is the only way to recover it efficiently. Uploading 50GB takes hours; uploading a hash takes milliseconds.