Where Does Hashcat Store Cracked Passwords?
Hashcat's potfile default, session restore files, and the flags that relocate both.
Last updated
Hashcat records every cracked pair in a potfile that defaults to hashcat.potfile in the working directory. Future runs consult it first, which is why known hashes crack instantly the second time.
Interrupted jobs persist separately as .restore files per named session. Pair --show and --left against the potfile to audit progress without rerunning a single candidate.
Where Hashcat stores this, by platform
[HashcatDir]\hashcat.potfile
Default beside the binary. Relocate with --potfile-path my.pot, disable with --potfile-disable. Restore files per --session alongside it unless --restore-file-path says otherwise.
[HashcatDir]/hashcat.potfile
Same defaults. Some hash modes opt out of potfile writes entirely, so a missing entry does not always mean a failed crack.
[HashcatDir]/hashcat.potfile
Same defaults. Resume with --session name plus --restore, which prints the held command line and stops for confirmation.
Frequently asked questions
How do I list already cracked hashes?
Run with --show against the hash list and potfile. --left instead shows what remains, which drives the next wordlist choice.
Where did my interrupted session go?
Into a .restore file named for the session. Resume with the same --session value plus --restore from the same directory.
Notice an outdated path? Let us know.