Hashcat Rules Generator

A hashcat rule-based attack (attack modes 0, 6 and 7) applies text-mutation functions to each word from a wordlist or mask before it is checked against a hash - for example, capitalizing it, appending digits, or substituting letters for lookalike symbols. One rule line can chain several functions, so a single wordlist word can produce many realistic password candidates without writing them all out.

Build a rule here, download it, and run something like: hashcat -m 0 -a 0 hash.txt wordlist.txt -r myrules.rule. Each line of the file is applied to every word in the wordlist. Use this only against hashes you are authorized to test, such as your own accounts or an engagement you have explicit permission for.

A chain is the sequence of functions you build on the left - for example Capitalize, then a@, then append '!' - and it becomes one rule line such as "c sa@ $!". Applied to a word, a chain produces exactly one mutated candidate. A rule set is a list of separate lines; add a finished chain to the set to build up several different mutations, then export them together as one .rule file.

A rule engine has to match hashcat's function letters and parameter handling exactly, including position encoding (0-9, then A-Z for positions 10 and above) - a small mismatch, such as using the wrong letter for a function or testing functions as independent alternatives instead of as a single chain, produces a preview that looks right but a rule file that behaves differently in real hashcat. This tool's engine is checked against hashcat's own published function table, and the same function logic drives both the live test and the exported file, so what you test is what you export.

Yes, but hashcat's own $ and ^ functions each take exactly one character. Appending "2024", for example, is really four chained functions: $2$0$2$4. When you add a multi-character append or prepend, this tool expands it into the correct chain automatically, so the exported rule works the same in real hashcat.

Yes. It parses every function and parameter in your chain and in your rule set against hashcat's real syntax, and reports the first problem it finds - an unknown function letter, a missing parameter, or similar - rather than a message that is always positive.

Many functions take a character position, counting from 0. Hashcat encodes positions as a single character: 0-9 for positions 0 to 9, then A-Z for positions 10 to 35, so a word longer than 10 characters can still be addressed with one character per function. This tool follows the same encoding.

It covers the documented single-character functions from hashcat's rule reference, including position-based edit, duplication, rotation and character-shift functions. It does not implement hashcat's memory-register functions (such as M, Q, 6, 4, X) or rejection rules, which are less commonly hand-built and depend on cracking-session state this browser tool does not have.

No. Everything runs locally in your browser. Rule sets you explicitly save are kept in your browser's local storage on this device only, nothing is uploaded, and downloaded files are saved to your device like any other download.

Penetration testers and red teamers with authorized engagements, and security teams running their own password-policy or password-reuse assessments. It is not a hash cracker itself - it only builds the rule file you would feed to hashcat.