Skip to content


Crunch is a wordlist generator where you can specify a standard character set or a character set you specify. crunch can generate all possible combinations and permutations.
crunch Homepage | Kali crunch Repo


  • crunch generates wordlists in both combination and permutation ways
  • it can breakup output by number of lines or file size
  • resume support
  • pattern now supports number and symbols
  • pattern now supports upper and lower case characters separately
  • adds a status report when generating multiple files
  • new -l option for literal support of @,%^
  • new -d option to limit duplicate characters see man file for details
  • unicode support

Crunch can create a wordlist based on criteria you specify.  The output from crunch can be sent to the screen, file, or to another program.

Usage: crunch [options]

The min and max are the minimum and maximum lengths (respectively) for your desired wordlist. By default charset is not required, but you can use it to limit the characters of your wordlist to the ones you specify. If you choose to use charset then you must maintain the correct order, which is lowUP123@%# (lowercase letters, then uppercase letters, then numbers and finally symbols). You can skip any of them, but the order must always remain the same.


-b : the maximum size of the wordlist (requires -o START)

-c : numbers of lines to write to the wordlist (requires -o START)

-d : limit the number of duplicate characters

-e : stop generating words at a certain string

-f : specify a list of character sets from the charset.lst file

-i : invert the order of characters in the wordlist

-l : allows the literal interpretation of @,%^ when using -t

-o : the output wordlist file

-p : print permutations without repeating characters (cannot be used with -s)

-q : Like the -p option except it reads the strings from a specified file

-r : resume a previous session (cannot be used with -s)

-s : specify a particular string to begin the wordlist with

-t : set a specific pattern of @,%^

-z : compress the output wordlist file, accompanied by -o


@ represents lowercase letters

, represents uppercase letters

% represents numbers

^ represents special characters

Example 1:

crunch 2 6 qrs347

The command above will produce a wordlist for every possible combination of the characters qrs347 from 2 to 6 characters in length.

Example 2:

crunch 6 6 0123456789abcdef -o 6chars.txt

Generate a dictionary file containing words with a minimum and maximum length of 6 (6 6) using the given characters (0123456789abcdef), saving the output to a file (-0 6chars.txt):

Example 3:

crunch 5 5 abcde14 -t @@@14 -d 2@ -o syskey.txt -z

A zipped syskey.txt wordlist starting with “aab14” and ending in “eed14” will be produced from the above. The reason why the start is not “aaa14” is because -d 2@ allows for only 2 duplicate lowercase letters. Adding -i would invert the results, and adding -e dde14 would stop after the line “dde14” (or “41edd” in the case of an inverted output) is produced.

Example 4:

crunch 5 5 bcopuw2468 -s cow28 -c 33 -b 20mb -o START

The above will result in a 20mb text file and containing combinations for bcopuw2468 starting with “cow28” and ending on the 33rd line of the theoretical outcome.

Example 5:

crunch 2 4 -p kite sky car -o owl.txt

In this example the words ‘kite’ ‘sky’ and ‘car’ will be printed in all orders possible (wholly, not by letter) and outputted into output owl.txt without taking into account the min and max numbers. None of the words will be repeated. If only one word is included, it will will be used as a character set. You could use -q instead of -p to extract words from a specific file.

Example 6:

crunch 6 6 -t @^42%3 -l a^aaaa -o art.txt

In this case Crunch will will treat the ^ symbol as itself, rather than a representative of a special character. The sequence will commence with “a^4213” and end in “z^4293” and the output art.txt will be produced.

Example 7:

crunch 4 6 -f /path/to/charset.lst -o words.txt

Assume the situation where you enter the above command and then decide to pause the process midway. When you come back later, you may restore the session by adding -r option to the syntax, while keeping the rest exactly the same.

More Examples from Crunch Man Pages:

Example 1
       crunch 1 8
       crunch will display a wordlist that starts at a and ends at zzzzzzzz

Example 2
       crunch 1 6 abcdefg
       crunch  will  display a wordlist using the character set abcdefg that starts at a and ends
       at gggggg

Example 3
       crunch 1 6 abcdefg\
       there is a space at the end of the character string.  In order for crunch to use the space
       you  will  need  to  escape  it using the \ character.  In this example you could also put
       quotes around the letters and not need the \, i.e. “abcdefg  “.   Crunch  will  display  a
       wordlist using the character set abcdefg  that starts at a and ends at (6 spaces)

Example 4
       crunch 1 8 -f charset.lst mixalpha-numeric-all-space -o wordlist.txt
       crunch  will  use  the  mixalpha-numeric-all-space character set from charset.lst and will
       write the wordlist to a file named wordlist.txt.  The file will start with a and end  with
       ”        “

Example 5
       crunch  8  8  -f  charset.lst  mixalpha-numeric-all-space  -o  wordlist.txt -t @@dog@@@ -s
       crunch  should  generate  a  8  character  wordlist  using  the  mixalpha-number-all-space
       character  set  from charset.lst and will write the wordlist to a file named wordlist.txt.
       The file will start at cbdogaaa and end at ”  dog   “

Example 6
       crunch 2 3 -f charset.lst ualpha -s BB
       crunch with start generating a wordlist at BB and end with ZZZ.  This  is  useful  if  you
       have to stop generating a wordlist in the middle.  Just do a tail wordlist.txt and set the
       -s parameter to the next word in the sequence.  Be sure to rename  the  original  wordlist
       BEFORE you begin as crunch will overwrite the existing wordlist.

Example 7
       crunch 4 5 -p abc
       The numbers aren’t processed but are needed.
       crunch will generate abc, acb, bac, bca, cab, cba.

Example 8
       crunch 4 5 -p dog cat bird
       The numbers aren’t processed but are needed.
       crunch   will   generate   birdcatdog,  birddogcat,  catbirddog,  catdogbird,  dogbirdcat,

Example 9
       crunch 1 5 -o START -c 6000 -z bzip2
       crunch will generate bzip2 compressed files with each file  containing  6000  words.   The
       filenames of the compressed files will be first_word-last_word.txt.bz2

# time ./crunch 1 4 -o START -c 6000 -z gzip
       real    0m2.729s
       user    0m2.216s
       sys     0m0.360s

# time ./crunch 1 4 -o START -c 6000 -z bzip2
       real    0m3.414s
       user    0m2.620s
       sys     0m0.580s

# time ./crunch 1 4 -o START -c 6000 -z lzma
       real    0m43.060s
       user    0m9.965s
       sys     0m32.634s

size  filename
       30K   aaaa-aiwt.txt
       12K   aaaa-aiwt.txt.gz
       3.8K  aaaa-aiwt.txt.bz2
       1.1K  aaaa-aiwt.txt.lzma

Example 10
       crunch 4 5 -b 20mib -o START
       will generate 4 files: aaaa-gvfed.txt, gvfee-ombqy.txt, ombqz-wcydt.txt, wcydu-zzzzz.txt
       the first three files are 20MBs (real power of 2 MegaBytes) and the last file is 11MB.

Example 11
       crunch 3 3 abc + 123 !@# -t @%^
       will  generate a 3 character long word with a character as the first character, and number
       as the second character, and a symbol for the third character.  The  order  in  which  you
       specify  the  characters  you want is important.  You must specify the order as lower case
       character, upper case character, number, and  symbol.   If  you  aren’t  going  to  use  a
       particular  character  set  you use a plus sign as a placeholder.  As you can see I am not
       using the upper case character set so I am using the plus  sign  placeholder.   The  above
       will start at a1! and end at c3#

Example 12
       crunch 3 3 abc + 123 !@# -t ^%@
       will generate 3 character words starting with !1a and ending with #3c

Example 13
       crunch 4 4  + + 123 + -t %%@^
       the  plus  sign (+) is a place holder so you can specify a character set for the character
       type.  crunch will use the default character  set  for  the  character  type  when  crunch
       encounters  a  + (plus sign) on the command line.  You must either specify values for each
       character type or use the plus sign.  I.E. if you  have  two  characters  types  you  MUST
       either  specify values for each type or use a plus sign.  So in this example the character
       sets will be:
       there is a space at the end of the above string
       the output will start at 11a! and end at “33z “.  The quotes show the space at the end  of
       the string.

Example 14
       crunch 5 5 -t ddd@@ -o j -p dog cat bird
       any character other than one of the following: @,%^
       is  the  placeholder for the words to permute.  The @,%^ symbols have the same function as
       If you want to use @,%^ in your output  you  can  use  the  -l  option  to  specify  which
       character you want crunch to treat as a literal.
       So the results are

Example 15
       crunch 7 7 -t p@ss,%^ -l a@aaaaa
       crunch  will  now  treat the @ symbol as a literal character and not replace the character
       with a uppercase letter.
       this will generate

Example 16
       crunch 5 5 -s @4#S2 -t @%^,2 -e @8 Q2 -l @dddd -b 10KB -o START
       crunch will generate 5 character strings starting with @4#S2 and ending  at  @8  Q2.   The
       output  will  be  broken  into  10KB  sized  files named for the files starting and ending

Example 17
       crunch 5 5 -d 2@ -t @@@%%
       crunch will generate 5 character strings staring with aab00 and ending at  zzy99.   Notice
       that aaa and zzz are not present.

Example 18
       crunch 10 10 -t @@@^%%%%^^ -d 2@ -d 3% -b 20mb -o START
       crunch  will generate 10 character strings starting with aab!0001!! and ending at zzy 9998
       The output will be written to 20mb files.

Example 19
       crunch 8 8 -d 2@
       crunch will generate 8 characters that limit the same number of lower case  characters  to
       2.  Crunch will start at aabaabaa and end at zzyzzyzz.

Example 20
       crunch 4 4 -f unicode_test.lst japanese -t @@%% -l @xdd
       crunch  will  load some Japanese characters from the unicode_test character set file.  The
       output will start at @日00 and end at @語99.