The system administrator wishes to use John the Ripper to confirm that the passwords in a file called passwords are not weak. john has finished but the terminal window running the program has…

The correct answer is D. john show passwords. See the full explanation below for the reasoning.

Question

The system administrator wishes to use John the Ripper to confirm that the passwords in a file called passwords are not weak. john has finished but the terminal window running the program has closed. What command can be used to list any cracked passwords for this file?

Options

Ajohn list passwords
Bjohn list
Cjohn show
Djohn show passwords

How the community answered

(63 responses)

A
8% (5)
B
5% (3)
C
16% (10)
D
71% (45)

Community Discussion

Orla P.May 20, 2026

D is the one you want. When john finishes a session, it writes the cracked results to a pot file, and running "john --show passwords" (or just "john show passwords" in older syntax) reads that pot file and filters it against the specific wordlist or hash file you name, so you only see results tied to your passwords file rather than everything john has ever cracked on that machine. Option C, "john show" without naming the file, is incomplete because it needs the target file as an argument to know which hashes to report on. A and B are just wrong syntax entirely. Always name your file when you run the show command, otherwise you might think nothing cracked when results are sitting right there in the pot.

Marit C.May 18, 2026

D is correct, and the reason C is a tempting wrong answer is that john --show without a filename argument is syntactically accepted but gives you results from the pot file without filtering to the specific hash file you care about, which means you might see cracked entries from completely unrelated audit runs. The whole point of specifying the file is that john cross-references ~/.john/john.pot against the hashes in that particular input file and prints only the matches relevant to this job. A and B are just fabricated syntax, john has no "list" subcommand in that form. So the correct invocation is john --show passwords, which is what option D represents, and that is exactly what you reach for when the session is gone but the pot file persists on disk.

Carlos M.May 5, 2026

D is right. When john finishes a session, it saves cracked passwords to a pot file, and running "john --show passwords" reads that pot file and matches results back to the specific password file you name, so omitting the filename like in option C would leave john without the context it needs to filter the output correctly.

Orla P.May 6, 2026

Carlos has it right, though worth adding that the pot file itself is global and shared across all your cracking sessions, so if you have cracked hashes from multiple different hash files over time, the output of john --show can surface matches you did not even intend for that current job, which is exactly why specifying the target file keeps things clean and relevant.

Nina C.May 15, 2026

Does "show" display only cracked ones, or all entries in the file?

Ola B.May 11, 2026

"john --show passwords" right, but does anyone know why you have to specify the file again after cracking?

Full 117-303 Practice