Crunch is a wordlist generator where you can specify a standard character set or a character set you specify. crunch can generate all possible combinations and permutations.
crunch Homepage | Kali crunch Repo
- crunch generates wordlists in both combination and permutation ways
- it can breakup output by number of lines or file size
- resume support
- pattern now supports number and symbols
- pattern now supports upper and lower case characters separately
- adds a status report when generating multiple files
- new -l option for literal support of @,%^
- new -d option to limit duplicate characters see man file for details
- unicode support
Crunch can create a wordlist based on criteria you specify. The output from crunch can be sent to the screen, file, or to another program.
Usage: crunch [options]
The min and max are the minimum and maximum lengths (respectively) for your desired wordlist. By default charset is not required, but you can use it to limit the characters of your wordlist to the ones you specify. If you choose to use charset then you must maintain the correct order, which is lowUP123@%# (lowercase letters, then uppercase letters, then numbers and finally symbols). You can skip any of them, but the order must always remain the same.
-b : the maximum size of the wordlist (requires -o START)
-c : numbers of lines to write to the wordlist (requires -o START)
-d : limit the number of duplicate characters
-e : stop generating words at a certain string
-f : specify a list of character sets from the charset.lst file
-i : invert the order of characters in the wordlist
-l : allows the literal interpretation of @,%^ when using -t
-o : the output wordlist file
-p : print permutations without repeating characters (cannot be used with -s)
-q : Like the -p option except it reads the strings from a specified file
-r : resume a previous session (cannot be used with -s)
-s : specify a particular string to begin the wordlist with
-t : set a specific pattern of @,%^
-z : compress the output wordlist file, accompanied by -o
@ represents lowercase letters
, represents uppercase letters
% represents numbers
^ represents special characters
crunch 2 6 qrs347
The command above will produce a wordlist for every possible combination of the characters qrs347 from 2 to 6 characters in length.
crunch 6 6 0123456789abcdef -o 6chars.txt
Generate a dictionary file containing words with a minimum and maximum length of 6 (6 6) using the given characters (0123456789abcdef), saving the output to a file (-0 6chars.txt):
crunch 5 5 abcde14 -t @@@14 -d 2@ -o syskey.txt -z
A zipped syskey.txt wordlist starting with “aab14” and ending in “eed14” will be produced from the above. The reason why the start is not “aaa14” is because -d 2@ allows for only 2 duplicate lowercase letters. Adding -i would invert the results, and adding -e dde14 would stop after the line “dde14” (or “41edd” in the case of an inverted output) is produced.
crunch 5 5 bcopuw2468 -s cow28 -c 33 -b 20mb -o START
The above will result in a 20mb text file and containing combinations for bcopuw2468 starting with “cow28” and ending on the 33rd line of the theoretical outcome.
crunch 2 4 -p kite sky car -o owl.txt
In this example the words ‘kite’ ‘sky’ and ‘car’ will be printed in all orders possible (wholly, not by letter) and outputted into output owl.txt without taking into account the min and max numbers. None of the words will be repeated. If only one word is included, it will will be used as a character set. You could use -q instead of -p to extract words from a specific file.
crunch 6 6 -t @^42%3 -l a^aaaa -o art.txt
In this case Crunch will will treat the ^ symbol as itself, rather than a representative of a special character. The sequence will commence with “a^4213” and end in “z^4293” and the output art.txt will be produced.
crunch 4 6 -f /path/to/charset.lst -o words.txt
Assume the situation where you enter the above command and then decide to pause the process midway. When you come back later, you may restore the session by adding -r option to the syntax, while keeping the rest exactly the same.
More Examples from Crunch Man Pages:
crunch 1 8
crunch will display a wordlist that starts at a and ends at zzzzzzzz
crunch 1 6 abcdefg
crunch will display a wordlist using the character set abcdefg that starts at a and ends
crunch 1 6 abcdefg\
there is a space at the end of the character string. In order for crunch to use the space
you will need to escape it using the \ character. In this example you could also put
quotes around the letters and not need the \, i.e. “abcdefg “. Crunch will display a
wordlist using the character set abcdefg that starts at a and ends at (6 spaces)
crunch 1 8 -f charset.lst mixalpha-numeric-all-space -o wordlist.txt
crunch will use the mixalpha-numeric-all-space character set from charset.lst and will
write the wordlist to a file named wordlist.txt. The file will start with a and end with
crunch 8 8 -f charset.lst mixalpha-numeric-all-space -o wordlist.txt -t @@dog@@@ -s
crunch should generate a 8 character wordlist using the mixalpha-number-all-space
character set from charset.lst and will write the wordlist to a file named wordlist.txt.
The file will start at cbdogaaa and end at ” dog “
crunch 2 3 -f charset.lst ualpha -s BB
crunch with start generating a wordlist at BB and end with ZZZ. This is useful if you
have to stop generating a wordlist in the middle. Just do a tail wordlist.txt and set the
-s parameter to the next word in the sequence. Be sure to rename the original wordlist
BEFORE you begin as crunch will overwrite the existing wordlist.
crunch 4 5 -p abc
The numbers aren’t processed but are needed.
crunch will generate abc, acb, bac, bca, cab, cba.
crunch 4 5 -p dog cat bird
The numbers aren’t processed but are needed.
crunch will generate birdcatdog, birddogcat, catbirddog, catdogbird, dogbirdcat,
crunch 1 5 -o START -c 6000 -z bzip2
crunch will generate bzip2 compressed files with each file containing 6000 words. The
filenames of the compressed files will be first_word-last_word.txt.bz2
# time ./crunch 1 4 -o START -c 6000 -z gzip
# time ./crunch 1 4 -o START -c 6000 -z bzip2
# time ./crunch 1 4 -o START -c 6000 -z lzma
crunch 4 5 -b 20mib -o START
will generate 4 files: aaaa-gvfed.txt, gvfee-ombqy.txt, ombqz-wcydt.txt, wcydu-zzzzz.txt
the first three files are 20MBs (real power of 2 MegaBytes) and the last file is 11MB.
crunch 3 3 abc + 123 !@# -t @%^
will generate a 3 character long word with a character as the first character, and number
as the second character, and a symbol for the third character. The order in which you
specify the characters you want is important. You must specify the order as lower case
character, upper case character, number, and symbol. If you aren’t going to use a
particular character set you use a plus sign as a placeholder. As you can see I am not
using the upper case character set so I am using the plus sign placeholder. The above
will start at a1! and end at c3#
crunch 3 3 abc + 123 !@# -t ^%@
will generate 3 character words starting with !1a and ending with #3c
crunch 4 4 + + 123 + -t %%@^
the plus sign (+) is a place holder so you can specify a character set for the character
type. crunch will use the default character set for the character type when crunch
encounters a + (plus sign) on the command line. You must either specify values for each
character type or use the plus sign. I.E. if you have two characters types you MUST
either specify values for each type or use a plus sign. So in this example the character
sets will be:
there is a space at the end of the above string
the output will start at 11a! and end at “33z “. The quotes show the space at the end of
crunch 5 5 -t ddd@@ -o j -p dog cat bird
any character other than one of the following: @,%^
is the placeholder for the words to permute. The @,%^ symbols have the same function as
If you want to use @,%^ in your output you can use the -l option to specify which
character you want crunch to treat as a literal.
So the results are
crunch 7 7 -t p@ss,%^ -l a@aaaaa
crunch will now treat the @ symbol as a literal character and not replace the character
with a uppercase letter.
this will generate
crunch 5 5 -s @4#S2 -t @%^,2 -e @8 Q2 -l @dddd -b 10KB -o START
crunch will generate 5 character strings starting with @4#S2 and ending at @8 Q2. The
output will be broken into 10KB sized files named for the files starting and ending
crunch 5 5 -d 2@ -t @@@%%
crunch will generate 5 character strings staring with aab00 and ending at zzy99. Notice
that aaa and zzz are not present.
crunch 10 10 -t @@@^%%%%^^ -d 2@ -d 3% -b 20mb -o START
crunch will generate 10 character strings starting with aab!0001!! and ending at zzy 9998
The output will be written to 20mb files.
crunch 8 8 -d 2@
crunch will generate 8 characters that limit the same number of lower case characters to
2. Crunch will start at aabaabaa and end at zzyzzyzz.
crunch 4 4 -f unicode_test.lst japanese -t @@%% -l @xdd
crunch will load some Japanese characters from the unicode_test character set file. The
output will start at @日00 and end at @語99.