HASHCAT RULE EFFECTIVENESS
RULES EFFICIENCY
Efficiency Metric
Golden Zone
Tier Leaders
Scenario Picks
Efficiency = % Recovered ÷ Rules Count (from benchmark CSV)
234 rule sets benchmarked. Each point's shape and colour on the scatter chart indicates its family. Card suit badges — ♠♥♦♣ — mark the top performers across four dimensions.
Hall of Fame — Card Rank Award System
Four dimensions of excellence. Each top rule earns a card suit badge shown throughout the table and scatter chart.
♠Top recovery in its tier — the overall cracking champion
♥Top efficiency — most hashes per rule (≤10k rules)
♦Best balance — top 15 in BOTH recovery and efficiency ranks
♣Family champion — #1 rule in its group
%Recovered vs. Efficiency (Log Scale)
The top-right zone marks rule sets that crack many hashes with high efficiency — ideal for GPU-limited or speed-first workflows.
Larger / outlined points are card-rank award winners. Each family uses a distinct shape and colour.
Head-to-Head Rule Comparison
Search and compare any two rule sets across all five metrics. Winner highlighted in green with visual bars.
Strategic Recommendations — Scenario-Based Ruleset Picks
Five battle-tested scenarios drawn from the full 232-ruleset benchmark. Each recommendation is grounded in the efficiency and recovery data above — not guesswork.
Scenario 1
⚡ Speed-First / GPU-Constrained — Tiny Tier Chain
When every second of GPU time matters — red team ops, rate-limited cloud instances, or quick triage — lead with maximum-efficiency tiny rulesets. These three together cover the majority of low-hanging fruit at almost zero cost.
ultra.rule
31 rules · Efficiency: 287.42 — all-time #1
The single most efficient ruleset in the entire benchmark. Only 31 rules yet recovers 8.91%. Fire this first — it's essentially free.
top100hashmob.rule
104 rules · Recovery: 16.82% — tiny tier champion
Best absolute recovery of any sub-250-rule set. Efficiency of 161.73 puts it second only to ultra.rule. The definitive tiny-tier anchor.
jabbercracky_100.rule
100 rules · Efficiency: 63.2 · Recovery: 6.32%
Rounds out the trio with complementary transforms not covered by the first two. Adds incremental gains at negligible cost.
Combined effect: ~25–28% estimated cumulative recovery from just 235 rules total. Run sequentially with --remove to eliminate already-cracked hashes between passes.
Scenario 2
🎯 Best Single Ruleset — The All-Rounder
When you can only run one ruleset — scripted pipelines, automated tooling, or a single-shot engagement — this is the one to load.
100,000 rules · Recovery: 42.12% · Efficiency: 0.4212
Tier leader (♠) for the medium bracket. Highest recovery of any ruleset under 150k rules. The 100k rule count is the sweet spot where diminishing returns haven't yet set in — you get large-tier results at medium-tier GPU cost.
HashMob.50k.rule
50,000 rules · Recovery: 37.59% · Efficiency: 0.7518
Runner-up and a strong alternative when speed matters more. Nearly 2× the efficiency of the 100k version while still recovering 37.59%. The ♦ balance award contender.
Verdict: HashMob.100k.rule is the closest thing to a universally optimal single-pass rule. If your rig is tight on VRAM or time, drop to the 50k version — you sacrifice ~4.5 pp recovery for nearly double the throughput.
Scenario 3
🏆 Maximum Recovery — DFIR / Full-Coverage Audits
Legal evidence recovery, internal audit, or any scenario where cracking rate trumps all — throw everything at it. These are the top-recovery kings regardless of efficiency.
#1 recovery overall · 56.94% · 4,003,430 rules
The undisputed recovery champion across all 232 rulesets. No other ruleset cracks more hashes. Run this when the job must be done regardless of time.
A11313M.rule
3,207,290 rules · Recovery: 53.97% · A1131 family
The A1131 mega-rule. Slightly fewer rules than Fordyv4a yet nearly as effective — a compelling second pass that adds complementary transforms for stubborn hashes that Fordy misses.
sapphire_v1.rule
1,270,145 rules · Recovery: 52.06% · eff: 0.041
Best big-tier efficiency among the top-5 recovery rulesets. Nearly matches the giants at ~1/3rd the rule count — ideal as a third pass after Fordy + A11313M.
Pro tip: On identical wordlists, Fordyv4a → A11313M → sapphire_v1 with --remove between passes can realistically push combined recovery past 65–70%.
Scenario 4
⚖️ Best Balance — The ♦ Diamond Tier
Rules that rank in the top 15 of both recovery and efficiency simultaneously — the ♦ diamond winners. These are the rulesets that punch well above their weight class.
35,399 rules · Recovery: 32.76% · Efficiency: 0.9255
Exceptional efficiency for a medium-tier set. Recondite's focused rule philosophy yields best-in-class hashes-per-rule ratios without sacrificing meaningful recovery.
♦
concentrator_MT_50000.rule
50,000 rules · Recovery: 36.71% · Efficiency: 0.7342
The Concentrator family's flagship balanced entry. Machine-generated and optimised specifically for high-density coverage — the best of algorithmic ruleset generation.
50,000 rules · Recovery: 36.14% · Efficiency: 0.7228
Sapphire's mid-range entry delivers remarkable consistency. Complements Concentrator well — different rule philosophies means low overlap, ideal for sequential chaining.
Scenario 5
🔗 The Layered Campaign — Optimal 4-Pass Chain
The highest-ROI cracking strategy: layer four rulesets from different families and tiers in ascending cost order. Each pass removes solved hashes so later passes only work on what remains — compounding gains without compounding waste.
Pass
Ruleset
Est. Cost
1 · TINY
top100hashmob.rule104 rules · 16.82% rec · eff 161.73
~seconds
2 · SMALL
concentrator_MT_5000.rule5,000 rules · 23.38% rec · eff 4.676
~minutes
3 · MEDIUM
HashMob.100k.rule100,000 rules · 42.12% rec · eff 0.4212
~hours
4 · BIG
Fordyv4a.rule4,003,430 rules · 56.94% rec · eff 0.014
overnight
Why this chain works: Each tier uses a different family (Hashmob → Concentrator → Hashmob → Fordy) to minimise rule overlap. The tiny and small passes handle most "easy" hashes in under an hour, so the expensive large pass only grinds through genuinely hard targets — cutting total GPU-hours by an estimated 40–60% versus running large-tier alone. Always append --remove to each hashcat invocation.