Hashcat on Apple Silicon: GPU-Accelerated Password Cracking

Apple Silicon Macs (M1, M2, M3, M4) aren't just for creative work and AI inference—they're surprisingly capable password-cracking machines. With hashcat's native Metal backend, you can leverage those GPU cores for high-speed hash cracking right from your MacBook.

Legal Disclaimer: Only use hashcat on systems and data you own or have explicit written permission to test. Unauthorized password cracking is illegal and can result in criminal prosecution. This guide is for educational and authorized security testing purposes only.

Why Apple Silicon for Password Cracking?

Traditionally, password cracking has been dominated by NVIDIA GPUs with their CUDA cores. But Apple Silicon changes the game for Mac users:

• Native Metal support since hashcat v6.2.5 (no more CPU-only or Rosetta workarounds)
• Unified memory architecture means the GPU can access all system RAM
• Power efficiency makes it practical for extended cracking sessions on laptops
• No external GPU needed for respectable performance

Important: Apple Silicon won't beat a dedicated NVIDIA RTX 4090 in raw speed. But for Mac users, it's the best option available—and it's surprisingly capable.

Performance Comparison

Apple Silicon vs NVIDIA GPUs

Let's be realistic about expectations. Here's how Apple Silicon compares to dedicated GPUs:

*Estimated based on scaling from benchmark data

The Reality Check

An RTX 3090 is roughly 5x faster than an M1 Max for WPA2 cracking. An RTX 4090 would be even faster.

But consider:

• An RTX 4090 costs $1,600+ and requires a desktop PC
• It draws 450W of power
• You can't take it to a coffee shop

If you already have a Mac with Apple Silicon, hashcat's Metal backend turns it into a capable cracking machine at no additional cost.

Performance Per Watt

Apple Silicon shines in efficiency:

The M2 Ultra actually delivers better performance per watt than an RTX 4090 for WPA2 cracking.

Apple Silicon Technical Specifications

Understanding your chip's specifications helps explain hashcat performance. More GPU cores and higher memory bandwidth directly translate to faster cracking.

M1 Family (5nm, 1st generation)

M2 Family (5nm, 2nd generation)

M3 Family (3nm, 1st generation)

M4 Family (3nm, 2nd generation)

Legend:

• P = Performance cores (high-power, fast)
• E = Efficiency cores (low-power, background tasks)
• TOPS = Trillion Operations Per Second (Neural Engine AI performance)
• Memory BW = Memory Bandwidth (higher = faster data transfer to GPU)
• B = Billion transistors

Key insight: GPU cores matter most for hashcat. The M2 Pro's 16-19 GPU cores explain why it achieves ~7,000 MH/s on MD5, roughly half of the M2 Max's 30-38 cores at ~16,700 MH/s.

Installation

Prerequisites

• macOS 12 (Monterey) or later
• Apple Silicon Mac (M1, M2, M3, or M4)
• Homebrew package manager

Install via Homebrew

# Install Homebrew if not already installed
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

# Install hashcat
brew install hashcat

Verify installation:

hashcat --version

You need hashcat v6.2.5 or later for Metal support. Homebrew typically provides the latest version.

Verify Metal Backend

Check that hashcat detects your GPU:

hashcat -I

You should see output like:

Backend Device ID #1 (Alias: #2)
  Type...........: GPU
  Vendor.ID......: 8
  Vendor.........: Apple Inc.
  Name...........: Apple M2 Max
  Processor(s)...: 38
  Backend........: Metal

Note: You may see "Device #2: Apple's OpenCL drivers (GPU) are known to be unreliable." This is expected—hashcat automatically uses the Metal backend instead.

Running Benchmarks

Test your system's performance across all hash types:

hashcat -b

For a specific hash type (e.g., WPA2):

hashcat -b -m 22000

Sample M2 Max Benchmark Output

Hashmode: 0 - MD5
Speed.#1.........: 16719.5 MH/s (75.50ms) @ Accel:512 Loops:1024 Thr:64 Vec:1

Hashmode: 100 - SHA1
Speed.#1.........:  6844.0 MH/s (75.53ms) @ Accel:256 Loops:1024 Thr:64 Vec:1

Hashmode: 1400 - SHA2-256
Speed.#1.........:  2622.9 MH/s (79.56ms) @ Accel:256 Loops:512 Thr:64 Vec:1

Hashmode: 22000 - WPA-PBKDF2-PMKID+EAPOL
Speed.#1.........:   250.3 kH/s (70.42ms) @ Accel:32 Loops:512 Thr:64 Vec:1

Cracking WPA2 Handshakes

If you captured a WPA2 handshake (see our Aircrack-ng tutorials), convert it to hashcat format:

# Install hcxtools
brew install hcxtools

# Convert capture file
hcxpcapngtool -o hash.hc22000 capture-01.cap

Then crack with hashcat:

hashcat -m 22000 hash.hc22000 ~/wordlists/rockyou.txt

Estimated WPA2 Cracking Times

Using rockyou.txt (~14 million passwords):

For larger wordlists or rule-based attacks, the time difference becomes more significant.

Optimization Tips

1. Use Optimized Kernels

The -O flag enables optimized kernels that boost speed at the cost of maximum password length (usually 32 characters):

hashcat -O -m 22000 hash.hc22000 wordlist.txt

2. Let the GPU Do the Work

Don't try to combine CPU and GPU processing. On Apple Silicon, the GPU alone provides better results:

# Use only the Metal GPU (device 2)
hashcat -d 2 -m 22000 hash.hc22000 wordlist.txt

3. Workload Profiles

Adjust workload intensity based on your use case:

# Low power (laptop on battery)
hashcat -w 1 -m 22000 hash.hc22000 wordlist.txt

# Default (balanced)
hashcat -w 2 -m 22000 hash.hc22000 wordlist.txt

# High performance (plugged in, dedicated cracking)
hashcat -w 3 -m 22000 hash.hc22000 wordlist.txt

# Nightmare mode (maximum performance, system may lag)
hashcat -w 4 -m 22000 hash.hc22000 wordlist.txt

4. Monitor Temperature

Apple Silicon throttles when hot. Keep your Mac cool:

# Check GPU temperature during cracking
sudo powermetrics --samplers smc -i 1000 | grep -i "GPU"

Consider:

• Using a laptop stand for better airflow
• Keeping ambient temperature low
• Avoiding blocking ventilation

5. Use Session Management

For long-running attacks, use sessions to resume if interrupted:

# Start with a session name
hashcat --session=wpa2crack -m 22000 hash.hc22000 wordlist.txt

# Resume later
hashcat --session=wpa2crack --restore

Attack Modes

Dictionary Attack (Mode 0)

The simplest attack—test every word in a wordlist:

hashcat -a 0 -m 22000 hash.hc22000 wordlist.txt

Dictionary + Rules (Mode 0 with rules)

Apply transformation rules to each word:

hashcat -a 0 -m 22000 hash.hc22000 wordlist.txt -r /opt/homebrew/share/hashcat/rules/best64.rule

Common rules included with hashcat:

• best64.rule - 64 effective transformations
• rockyou-30000.rule - 30,000 rules derived from rockyou analysis
• d3ad0ne.rule - Comprehensive rule set

Combinator Attack (Mode 1)

Combine words from two dictionaries:

hashcat -a 1 -m 22000 hash.hc22000 dict1.txt dict2.txt

Brute Force (Mode 3)

Try all combinations of a character set:

# 8-character lowercase + digits
hashcat -a 3 -m 22000 hash.hc22000 ?l?l?l?l?l?l?d?d

# Custom charset
hashcat -a 3 -m 22000 hash.hc22000 -1 ?l?d ?1?1?1?1?1?1?1?1

Character sets:

• ?l - lowercase (a-z)
• ?u - uppercase (A-Z)
• ?d - digits (0-9)
• ?s - special characters
• ?a - all printable ASCII

Hybrid Attacks (Modes 6 & 7)

Combine dictionary words with brute force:

# Word + 4 digits (password1234)
hashcat -a 6 -m 22000 hash.hc22000 wordlist.txt ?d?d?d?d

# 2 digits + word (12password)
hashcat -a 7 -m 22000 hash.hc22000 ?d?d wordlist.txt

Common Hash Types

Troubleshooting

"No devices found/left"

Ensure you're running hashcat v6.2.5 or later:

hashcat --version
brew upgrade hashcat

Metal Backend Not Detected

Check macOS version (requires 12+):

sw_vers

Hash Mode Skipped

Some hash modes don't work on Metal due to driver limitations. You'll see:

* Device #1: Skipping hash-mode 6211 - a]known Metal runtime and/or device driver issue (not a hashcat issue)

These modes require an NVIDIA GPU with CUDA.

Performance Lower Than Expected

1. Check if you're on battery power (throttled)
2. Verify thermal throttling isn't occurring
3. Use -w 3 or -w 4 for higher performance
4. Close other GPU-intensive applications

System Becomes Unresponsive

Use a lower workload profile:

hashcat -w 2 -m 22000 hash.hc22000 wordlist.txt

Or limit GPU usage with --gpu-temp-abort and --gpu-temp-retain.

Real-World Expectations

Be realistic about what Apple Silicon can accomplish:

Good for:

• Testing your own passwords and security policies
• CTF competitions and learning
• Cracking common/weak passwords
• Dictionary attacks with moderate wordlists
• Situations where you need portability

Not ideal for:

• Large-scale professional password auditing
• Attacking strong, unique passwords
• Competing with dedicated GPU rigs
• Hash types requiring CUDA

Summary

References

Official Documentation:

• Hashcat Official Website
• Hashcat Wiki
• Hashcat GitHub
• Hashcat Homebrew Formula

Apple Silicon Benchmarks:

• M1 Ultra Benchmarks by Chick3nman
• M2 Pro Benchmarks by crypt0rr
• M3 Pro Benchmarks by Chick3nman
• Hashcat on Apple Silicon Guide by Chris Reynolds

Apple Silicon Specifications:

• Apple M2 Pro/Max Announcement
• Apple M3 Family Announcement
• Apple M4 Pro/Max Announcement

Performance Optimization:

• Hashcat Forum: Apple Silicon Performance

Related Tutorials:

• Cracking WPA/WPA2 on Kali Linux
• Cracking WPA/WPA2 on Fedora