How to Crack a ZIP File Password with John the Ripper

 How to Crack a ZIP File Password with John the Ripper

If you've ever run into a password-protected ZIP file during a pentest, a CTF challenge, or while recovering your own archive, John the Ripper is one of the fastest ways to get in. In this walkthrough I'll show you the complete flow — from extracting the hash to cracking it to verifying the result — in just three commands.

Prefer video? I walk through this end-to-end in [the tutorial on my YouTube channel](https://www.youtube.com/@guskhawaja).

What You'll Need

• Kali Linux (or any distro with the `john` package installed)
• The `rockyou.txt` wordlist — ships with Kali at `/usr/share/wordlists/rockyou.txt`. If it's gzipped, unpack it first with `gunzip /usr/share/wordlists/rockyou.txt.gz`.
• Basic terminal familiarity

That's it. John the Ripper is already installed on Kali by default, along with its companion utility `zip2john`.

Why John the Ripper (and Not Just `unzip`)?

When a ZIP file is encrypted, the password isn't stored anywhere — what's stored is a hash derived from the password. `unzip` can't "try" passwords quickly; it's designed for interactive use. John the Ripper, on the other hand, is built for exactly this: loading a hash, running millions of password candidates against it per second, and stopping when it finds a match.

The catch is that John doesn't speak ZIP directly. It needs the hash in its own format. That's where `zip2john` comes in — a small utility that reads the ZIP header and dumps the hash in the format John expects.

Step 1 — Create a Test ZIP File (Optional)

If you want to follow along with a safe target, create your own encrypted archive:

echo "secret data" > note.txt

zip -e locked.zip note.txt

The `-e` flag tells `zip` to encrypt. You'll be prompted for a password. For demonstration I'll use `dragon` — it's in the rockyou wordlist, so John will find it almost instantly.

After this you'll have a `locked.zip` file that can't be opened without the password.

Step 2 — Extract the Hash with zip2john

This is the key step. We use `zip2john` to pull the password hash out of the archive and redirect it into a file John can work with:

zip2john locked.zip > hash.txt

Take a quick look at what came out:

cat hash.txt

You'll see something like this:

locked.zip/note.txt:$pkzip$1*1*2*0*18*c*a3f7*fce5*...*$/pkzip$

The `$pkzip$` prefix is the important part — it tells John which hash algorithm is in use. John supports a long list of zip-style formats (`pkzip`, `winzip`, etc.), and this prefix tells it to grab the right one automatically.

Step 3 — Crack the Hash with John

Now the main event. Point John at the hash file and give it a wordlist:

john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt

What's happening under the hood:

1. John reads the hash from `hash.txt` and auto-detects it as a PKZIP hash.

2. It opens the wordlist and starts iterating through candidate passwords.

3. For each candidate, it hashes the word with the same algorithm and compares against the target hash.

4. The first match wins. John prints the cracked password and exits.

On a modern laptop, `dragon` is found in well under a second because it's near the top of the rockyou wordlist. Stronger passwords obviously take longer — but the point stands: if the password is in your wordlist, John will find it.

Display the Result Cleanly

Once John finds a password, it saves it to its internal pot file (`~/.john/john.pot`). To print it cleanly, run:

john --show hash.txt

Output:

locked.zip/note.txt:dragon

1 password hash cracked, 0 left

That's your password: `dragon`

Step 4 — Verify by Unzipping

Prove it works by opening the archive with the recovered password:

unzip locked.zip

Enter `dragon` when prompted, and the file extracts:

Archive:  locked.zip

[locked.zip] note.txt password:

  inflating: note.txt

Open the file contents:

cat note.txt

Done. Three commands, one cracked password, one unlocked archive.

Troubleshooting

`rockyou.txt` is missing? On recent Kali installs the wordlist is gzipped. Run:

sudo gunzip /usr/share/wordlists/rockyou.txt.gz

John says "No password hashes loaded"? Open `hash.txt` and make sure the `$pkzip$` (or similar) prefix is present. If it's empty, `zip2john` couldn't parse the file — double-check the ZIP isn't corrupted.

Password not in rockyou? Try a larger wordlist (SecLists has several), or combine wordlists with rule-based mangling: `john --wordlist=rockyou.txt --rules hash.txt`. For truly strong passwords you'd move to incremental / brute-force mode — but at that point, the attack surface is very different.

Using a different hash prefix? Some zip formats produce `$zip2$` or `$pkzip2$` instead of `$pkzip$`. John handles them all — the prefix just tells it which format module to load.

When This Matters

In a real pentest, password-protected archives show up in a lot of places: email attachments, old backup drives, pivot points where someone stashed credentials in a zip, CTF flags hidden behind weak passwords. Knowing how to crack them quickly is a core skill.

Legal reminder: run this against your own files or files you have explicit written authorization to test. Cracking passwords on other people's archives is illegal in most jurisdictions, full stop.

What's Next

The same John the Ripper workflow works on dozens of formats beyond ZIP — RAR, 7z, SSH keys, PDF passwords, KeePass databases, shadow files. You swap `zip2john` for the matching converter (`rar2john`, `ssh2john`, `pdf2john`, etc.), and the rest of the flow is identical.

Written by Gus Khawaja (https://guskhawaja.me)