Where Does John the Ripper Store Cracked Passwords?
John the Ripper pot file, session and log locations, and how $JOHN decides the directory.
Last updated
John the Ripper records cracked passwords in john.pot inside its home directory, called $JOHN in the docs. That directory depends on how you installed John: the run folder for manual builds, a package path for distro installs, or ~/.john for common setups. Session state lands beside it as .rec files with logs in john.log.
The pot file does double duty. It archives results and also tells future runs to skip already cracked hashes, which speeds things up but confuses people testing new wordlists against old hashes. Knowing where the file sits turns both behaviors from mystery into routine.
Where John the Ripper stores this, by platform
~/.john/john.pot
Cheat sheets and labs consistently point here for distro installs. Session files (.rec) and john.log sit in the same directory. If $JOHN points elsewhere on your setup, the pot file follows it, so check your install's run folder.
[John install folder]\run\john.pot
Windows builds keep john.pot in the run directory next to john.exe rather than in AppData. The --show flag reads it the same way on every platform, so retrieval never depends on remembering the path.
~/.john/john.pot
Homebrew and manual macOS builds follow the Unix convention. The pot, session .rec files and john.log cluster together, so one folder copy preserves a whole cracking campaign.
Frequently asked questions
how do i see passwords john already cracked
Run john --show against the same hash file. It prints every cracked password John recorded for those hashes without re running any cracking, reading straight from the pot file.
john finds nothing on hashes i know are weak
Delete john.pot, or point John at a fresh session directory. John skips hashes already in the pot on every run, so a stale pot makes new wordlists look like they found nothing.
Notice an outdated path? Let us know.