Crunch Wordlist Generator for Ethical Hacking on Kali Linux

Public wordlists such as SecLists and rockyou.txt cover common passwords, but they miss formats your target actually uses. Crunch builds a custom list when you know part of the shape: a prefix, digit run, or a handful of words that might appear together.

This guide walks through Crunch on Kali Linux with real commands and trimmed output from each mode. Every example writes under /tmp/crunch-lab so you can delete the folder when you finish.

What is a wordlist generator in ethical hacking?

The rest of this guide turns partial password knowledge into a file you can pass to Hydra, John the Ripper, or Hashcat. You are not cracking anything inside Crunch itself — you are manufacturing candidates that match a hypothesis about how the password was built.

A wordlist generator enumerates password candidates from rules you specify: length range, character set, fixed pattern, or word order. Crunch is the default CLI generator on many Kali images and ships with preset charsets in /usr/share/crunch/charset.lst.

Crunch is most useful when you have a clue about structure:

• A company name plus two digits (pass01, pass02, …)
• Uppercase-only legacy accounts (AAA, AAB, …)
• A few words that might appear in one passphrase (dog, cat, bird)

Pattern placeholders in -t mode map to character classes:

Order matters when you mix classes on the command line: lowercase charset, then uppercase, then digits, then symbols. Use + as a placeholder when you skip a class (see the Crunch man page examples).

Install Crunch on Kali Linux

Crunch is preinstalled on many Kali releases, but the walkthrough below assumes you can install or refresh the package before you generate lists.

Install or refresh the package if crunch is missing:

sudo apt update
sudo apt install -y crunch

Confirm the binary responds:

crunch

crunch version 3.6

Crunch can create a wordlist based on criteria you specify.  The output from crunch can be sent to the screen, file, or to another program.

Usage: crunch <min> <max> [options]

Version 3.6 on this Kali image matches the crunch 3.6-3.1 package row in the intro table. Crunch is ready — set up a scratch directory next.

Kali lab setup

Point every example at one writable directory so you can inspect files and delete them after the lab. The variable keeps paths short in the commands below.

Create a scratch directory for generated lists:

LAB=/tmp/crunch-lab
mkdir -p "$LAB"

All -o paths below use "$LAB" so you can remove the folder with rm -rf /tmp/crunch-lab when you finish. Feed the resulting files into brute-force tools only on hosts you are authorized to test.

Compare Crunch generation modes

Crunch exposes several generation styles. Use this table to pick a mode before you scale up length or charset size — each section below runs the same lab directory with a different flag set.

Crunch prints the expected line count before it writes. Read that number before you run wide charsets at long lengths — 4 4 on mixed alphanumeric sets can reach millions of lines in seconds.

Generate a charset wordlist

Start with the smallest useful example: three characters from the set abc. That produces 27 lines (3³) so you can verify the file contents before you scale up.

Generate every three-letter combination from a, b, and c:

crunch 3 3 abc -o "$LAB/basic.txt"

Crunch will now generate the following number of lines: 27 

crunch: 100% completed generating output

The status line reports 27 lines — small enough to inspect on screen. The file ends at ccc:

wc -l "$LAB/basic.txt"

27 /tmp/crunch-lab/basic.txt

tail -3 "$LAB/basic.txt"

cca
ccb
ccc

Twenty-seven lines match 3³ combinations. For a wider alphabet at length four, hex digits produce 65,536 lines (16⁴):

crunch 4 4 0123456789abcdef -o "$LAB/hex4.txt"

Crunch will now generate the following number of lines: 65536 

crunch: 100% completed generating output

wc -l "$LAB/hex4.txt"

65536 /tmp/crunch-lab/hex4.txt

Sixty-five thousand lines still fit comfortably on disk. When you need lowercase plus digits at length four, expect a much larger count — estimate with Crunch’s preview line before you commit disk space.

Use charset.lst presets

Kali ships named charsets in /usr/share/crunch/charset.lst so you do not have to type long alphabet strings. The -f flag loads a preset by name.

List preset names:

grep -E '^[^#]' /usr/share/crunch/charset.lst | head -8

hex-lower                     = [0123456789abcdef]
hex-upper                     = [0123456789ABCDEF]
numeric                       = [0123456789]
numeric-space                 = [0123456789 ]
symbols14                     = [!@#$%^&*()-_+=]
symbols14-space               = [!@#$%^&*()-_+= ]
symbols-all                   = [!@#$%^&*()-_+=~`[]{}|\:;"'<>,.?/]
symbols-all-space             = [!@#$%^&*()-_+=~`[]{}|\:;"'<>,.?/ ]

Generate three-character uppercase words with the ualpha preset:

crunch 3 3 -f /usr/share/crunch/charset.lst ualpha -o "$LAB/ualpha.txt"

Crunch will now generate the following number of lines: 17576 

crunch: 100% completed generating output

head -3 "$LAB/ualpha.txt"

AAA
AAB
AAC

Seventeen thousand lines come from 26³ uppercase combinations. Pick a preset that matches what you know about the target — lalpha-numeric for lowercase plus digits, numeric for PIN-style lists, and so on.

Build patterned passwords with -t

When the password shape is fixed — a word plus digits, for example — -t fills pattern slots while you hold literal text in place. The pattern length must equal min and max length.

Build pass plus three lowercase letters (passaaa through passzzz):

crunch 7 7 -t pass@@@ -o "$LAB/pattern.txt"

Crunch will now generate the following number of lines: 17576 

crunch: 100% completed generating output

head -3 "$LAB/pattern.txt"

passaaa
passaab
passaac

tail -2 "$LAB/pattern.txt"

passzzy
passzzz

Seventeen thousand lines equal 26³ suffix combinations. For digit suffixes, swap @ for % in the pattern — crunch 7 7 -t pass%%% generates pass000 through pass999.

Mix classes with explicit charset segments and + placeholders when you need symbols or uppercase in specific positions (see man page examples 11–13). Add -d 2@ to limit consecutive duplicate letters when the target policy rejects them.

Permute words with -p

If you suspect a passphrase combines a few known words, -p permutes them without repeating characters inside each token. The -p flag must be the last option on the command line — placing -o after -p breaks parsing.

Permute three lab words and save stdout to a file:

crunch 4 5 -p dog cat bird > "$LAB/perm.txt"

Crunch will now generate approximately the following amount of data: 66 bytes
0 MB
0 GB
0 TB
0 PB
Crunch will now generate the following number of lines: 6

cat "$LAB/perm.txt"

birdcatdog
birddogcat
catbirddog
catdogbird
dogbirdcat
dogcatbird

Six lines are the 3! orderings of three distinct words. For longer token lists, read tokens from a file with -q filename instead of listing each word on the command line.

Cap or stop output

Full charset products grow quickly. Crunch offers three practical ways to keep output bounded: stop at a string (-e), split with -c and -o START, or pipe through head for a quick sample.

Stop early at a known boundary:

crunch 4 4 abc -e aaca -o "$LAB/early.txt"

Crunch will now generate the following number of lines: 7 

crunch: 100% completed generating output

tail -3 "$LAB/early.txt"

aabb
aabc
aaca

Seven lines run from aaaa through aaca inclusive. Use -e when you resume a previous session and know the last candidate you already tested.

For a quick cap without -e, preview then trim:

crunch 4 4 0123456789 | head -100 > "$LAB/first100.txt"

wc -l "$LAB/first100.txt"

100 /tmp/crunch-lab/first100.txt

The pipe keeps the first 100 numeric strings. For production-sized jobs, -c with -o START splits output into fixed line counts per file (see the Crunch man page example 9).

Split large wordlists with -b

Multi-gigabyte lists are awkward to copy and feed into tools. With -b and -o START, Crunch writes a series of files capped by size — each filename shows the first and last entry in that chunk.

Split three-digit numeric strings into roughly 2 KB files:

cd "$LAB" && crunch 3 3 0123456789 -b 2kb -o START

crunch: 100% completed generating output

ls -1 "$LAB"/*.txt | head -4

/tmp/crunch-lab/000-499.txt
/tmp/crunch-lab/500-999.txt

Two files cover the full 000–999 range at this size threshold. Raise -b to 20mb or 5mib when you generate longer passwords and need fewer fragments.

Compress output with -z

Compressed wordlists save space when you move files between lab machines or archive engagement data. Crunch can gzip, bzip2, lzma, or 7z the output file after generation.

Write a tiny list and gzip it in one step:

crunch 3 3 abc -z gzip -o "$LAB/abc.txt"

Crunch will now generate the following number of lines: 27 

crunch: 100% completed generating output
Beginning gzip compression.  Please wait.
abc.txt:	 53.7% -- replaced with abc.txt.gz

zcat "$LAB/abc.txt.gz" | head -5

aaa
aab
aac
aba
abb

Crunch replaces the plain file with abc.txt.gz. gzip is the fastest option; bzip2 and 7z trade speed for better compression on very large lists.

Troubleshooting

References

• Crunch (Kali tool page)
• Crunch man page (Debian)
• SecLists password collections (GitHub)
• Daniel Miessler SecLists project

Summary

Crunch turns partial password knowledge into files you can feed into Hydra, John, or Hashcat. In this lab you installed the tool on Kali, wrote charset ranges and charset.lst presets, built patterned lists with -t, permuted short word sets with -p, and managed size with -e, -b, and -z gzip.

The preview line Crunch prints before generation is your safety check — 3 3 abc is twenty-seven lines, but 4 4 on a wide charset can hit tens of thousands in one run. Match the mode to what you actually know about the target: patterns for fixed prefixes, -p for a handful of words, presets when the charset name already matches your hypothesis.

When a custom list recovers a login or hash in your lab, document the candidate format and continue in the SSH brute force walkthrough or John the Ripper guide — only on systems you are authorized to test.