HASHCAT RULE EFFECTIVENESS
RULES EFFICIENCY
Efficiency Metric
Golden Zone
Tier Leaders
Scenario Picks
238 rule sets benchmarked. Each point's shape and colour on the scatter chart indicates its family. Card suit badges — ♠♥♦♣ — mark the top performers across four dimensions.
Hall of Fame — Card Rank Award System
Four dimensions of excellence. Each top rule earns a card suit badge shown throughout the table and scatter chart.
♠Top recovery in its tier — the overall cracking champion
♥Top efficiency — most hashes per rule (≤10k rules)
♦Best balance — top 15 in BOTH recovery and efficiency ranks
♣Family champion — #1 rule in its group
%Recovered vs. Efficiency (Log Scale)
The top-right zone marks rule sets that crack many hashes with high efficiency — ideal for GPU-limited or speed-first workflows.
Larger / outlined points are card-rank award winners. Each family uses a distinct shape and colour.
Head-to-Head Rule Comparison
Search and compare any two rule sets across all five metrics. Winner highlighted in green with visual bars.
Strategic Recommendations — Scenario-Based Ruleset Picks
Five battle-tested scenarios drawn from the full 238-ruleset benchmark. Each recommendation is grounded in the efficiency and recovery data above — not guesswork.
Scenario 1
⚡ Speed-First / GPU-Constrained — Tiny Tier Chain
When every second of GPU time matters — red team ops, rate-limited cloud instances, or quick triage — lead with maximum-efficiency tiny rulesets. These three together cover the majority of low-hanging fruit at almost zero cost.
ultra.rule
31 rules · Efficiency: 287.42 — all-time #1
The single most efficient ruleset in the entire benchmark. Only 31 rules yet recovers 8.91%. Fire this first — it's essentially free.
top100hashmob.rule
104 rules · Recovery: 16.82% — tiny tier champion
Best absolute recovery of any sub-250-rule set. Efficiency of 161.73 puts it second only to ultra.rule. The definitive tiny-tier anchor.
jabbercracky_100.rule
100 rules · Efficiency: 63.2 · Recovery: 6.32%
Rounds out the trio with complementary transforms not covered by the first two. Adds incremental gains at negligible cost.
Combined effect: ~25–28% estimated cumulative recovery from just 235 rules total. Run sequentially with --remove to eliminate already-cracked hashes between passes.
Scenario 2
🎯 Best Single Ruleset — The All-Rounder
When you can only run one ruleset — scripted pipelines, automated tooling, or a single-shot engagement — this is the one to load.
100,000 rules · Recovery: 42.12% · Efficiency: 0.4212
Tier leader (♠) for the medium bracket. Highest recovery of any ruleset under 150k rules. The 100k rule count is the sweet spot where diminishing returns haven't yet set in — you get large-tier results at medium-tier GPU cost.
HashMob.50k.rule
50,000 rules · Recovery: 37.59% · Efficiency: 0.7518
Runner-up and a strong alternative when speed matters more. Nearly 2× the efficiency of the 100k version while still recovering 37.59%. The ♦ balance award contender.
Verdict: HashMob.100k.rule is the closest thing to a universally optimal single-pass rule. If your rig is tight on VRAM or time, drop to the 50k version — you sacrifice ~4.5 pp recovery for nearly double the throughput.
Scenario 3
🏆 Maximum Recovery — DFIR / Full-Coverage Audits
Legal evidence recovery, internal audit, or any scenario where cracking rate trumps all — throw everything at it. These are the top-recovery kings regardless of efficiency.
#1 recovery overall · 56.94% · 4,003,430 rules
The undisputed recovery champion across all 238 rulesets. No other ruleset cracks more hashes. Run this when the job must be done regardless of time.
A11313M.rule
3,207,290 rules · Recovery: 53.97% · A1131 family
The A1131 mega-rule. Slightly fewer rules than Fordyv4a yet nearly as effective — a compelling second pass that adds complementary transforms for stubborn hashes that Fordy misses.
sapphire_v1.rule
1,270,145 rules · Recovery: 52.06% · eff: 0.041
Best big-tier efficiency among the top-5 recovery rulesets. Nearly matches the giants at ~1/3rd the rule count — ideal as a third pass after Fordy + A11313M.
Pro tip: On identical wordlists, Fordyv4a → A11313M → sapphire_v1 with --remove between passes can realistically push combined recovery past 65–70%.
Scenario 4
⚖️ Best Balance — The ♦ Diamond Tier
Rules that rank in the top 15 of both recovery and efficiency simultaneously — the ♦ diamond winners. These are the rulesets that punch well above their weight class.
35,399 rules · Recovery: 32.76% · Efficiency: 0.9255
Exceptional efficiency for a medium-tier set. Recondite's focused rule philosophy yields best-in-class hashes-per-rule ratios without sacrificing meaningful recovery.
♦
concentrator_MT_50000.rule
50,000 rules · Recovery: 36.71% · Efficiency: 0.7342
The Concentrator family's flagship balanced entry. Machine-generated and optimised specifically for high-density coverage — the best of algorithmic ruleset generation.
50,000 rules · Recovery: 36.14% · Efficiency: 0.7228
Sapphire's mid-range entry delivers remarkable consistency. Complements Concentrator well — different rule philosophies means low overlap, ideal for sequential chaining.
Scenario 5
🔗 The Layered Campaign — Optimal 4-Pass Chain
The highest-ROI cracking strategy: layer four rulesets from different families and tiers in ascending cost order. Each pass removes solved hashes so later passes only work on what remains — compounding gains without compounding waste.
Pass
Ruleset
Est. Cost
1 · TINY
top100hashmob.rule104 rules · 16.82% rec · eff 161.73
~seconds
2 · SMALL
concentrator_MT_5000.rule5,000 rules · 23.38% rec · eff 4.676
~minutes
3 · MEDIUM
HashMob.100k.rule100,000 rules · 42.12% rec · eff 0.4212
~hours
4 · BIG
Fordyv4a.rule4,003,430 rules · 56.94% rec · eff 0.014
overnight
Why this chain works: Each tier uses a different family (Hashmob → Concentrator → Hashmob → Fordy) to minimise rule overlap. The tiny and small passes handle most "easy" hashes in under an hour, so the expensive large pass only grinds through genuinely hard targets — cutting total GPU-hours by an estimated 40–60% versus running large-tier alone. Always append --remove to each hashcat invocation.