I have a password-protected ZIP file for which I can’t remember the password.

I know that it was an easy password (most likely a variation of an existing German/English word), and I can

  • narrow down the length to a specific range (e.g., 6-10),
  • specify the characters that could have been used (e.g., A-Z, a-z, ß, ö, 0-9, _),
  • state the number of occurences of specific characters (e.g., _ was used exactly one time, 0 was used no more than two times), and
  • exclude certain patterns (e.g., not more than two numerals in a row).

I’m looking for a FLOSS password cracker for GNU/Linux that can find the password. It should (not must):

  • allow to specify limitations, ideally as described above (length, possible characters, min/max occurences, patterns) or similar
  • try a dictionary attack before falling back to a brute-force attack
  • log which passwords have been tried, and allow to import that log so that these passwords don’t have to be tried again when starting a new search (e.g., with adjusted limitations)
  • I tried fcrackzip some time ago, but I didn’t manage to crack a test password like aaaa with it (IIRC, because of issues with ZIP version). However, given a recommendation for fcrackzip, I’ll try it again.
    – unor
    Commented Oct 21, 2014 at 8:11
  • It shouldn't be difficult to do with bash
    – Vinz243
    Commented Oct 21, 2014 at 9:56
  • 1
    Long time ago I had the same issue and knew it was a 6 character password. I wrote a quick and dirty program that just called PKUNZIP (yes, in the DOS days) with generated passwords. After 5 days it hit the jackpot.
    – user416
    Commented Oct 21, 2014 at 9:57
  • 1
    There is cRARk which is great b/c it uses both CPU and GPU (via CUDA). But I'm not sure if it support zip files
    – Vinz243
    Commented Oct 21, 2014 at 10:30
  • 1
    John the Ripper has a good reputation as a password cracker. While it doesn't natively, there's a patch for it that does (search for “jumbo patch” on the project home page). Commented Nov 20, 2014 at 11:11

1 Answer 1


Pls check and see http://www.openwall.com/john/

John the Ripper is a fast password cracker, currently available for many flavors of Unix, Windows, DOS, BeOS, and OpenVMS. Its primary purpose is to detect weak Unix passwords. Besides several crypt(3) password hash types most commonly found on various Unix systems, supported out of the box are Windows LM hashes, plus lots of other hashes and ciphers in the community-enhanced version.

  • 2
    John the Ripper tries to invert password hashes. That's not much help to crack a zip file. The jumbo patch supports zip files though. Commented Nov 20, 2014 at 11:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.