UNIX Password Hash Formats
UNIX-style password hashes in /etc/shadow follow the Modular Crypt Format (MCF): $prefix$options$salt$hash. The prefix identifies the algorithm; the remaining fields parameterize it. 1
Common prefixes
| Prefix | Algorithm | Notes |
|---|---|---|
$1$ | md5crypt | Legacy; weak by modern standards |
$2a$, $2b$, $2x$, $2y$ | bcrypt | Common in web apps; designed to resist GPU cracking |
$5$ | sha256crypt | Less common |
$6$ | sha512crypt | Default on most modern Linux systems |
$y$ | yescrypt | Modern default on some distributions (e.g., Debian 11+) |
Field anatomy
$6$rounds=5000$somesalt$hashvalue- Prefix:
$6$= sha512crypt - Options:
rounds=5000(optional; default varies by algorithm) - Salt: arbitrary string, never purely numeric (distinguishes it from a rounds field)
- Hash: the actual digest
Both options and salt are optional in some algorithms, but salts are never purely numeric, making them easy to tell apart from round counts.
Why bcrypt resists GPU cracking
bcrypt is designed to require roughly the same computation time on a CPU as on a GPU. Unlike SHA-512, which parallelizes efficiently across thousands of GPU cores, bcrypt’s memory-hard Blowfish key schedule forces attackers to run hashes sequentially. This dramatically slows brute-force attacks on commodity hardware.
Checking /etc/shadow
# Extract just the hash prefixes on a system
sudo cut -d: -f2 /etc/shadow | cut -d'$' -f2 | sort | uniq -c | sort -rnSources
- crypt(5) — File Formats Manual (Debian unstable, libxcrypt)
- shadow(5) — Linux manual page
- crypt (C) — Wikipedia
Related: linux-reconnaissance-commands, cupp-common-user-passwords-profiler, cewl-custom-wordlist-generator, john-the-ripper, etc-shadow-weak-permissions, etc-passwd-weak-permissions