How do I use a leaked credential list?

Give Hydra a colon-separated login:pass file with -C instead of separate -L and -P lists. It replays each known pair once rather than crossing every login against every password.

Can Hydra brute-force passwords without a wordlist?

Yes. The -x generator takes a MIN:MAX:CHARSET spec, so -x 5:8:A1 tries every password of length 5 to 8 built from uppercase letters and digits. Add -r for a non-random order when you want a repeatable run.

How do I keep a run within service limits?

Tune -t for parallel connections per target and -T for the global cap, add -w to wait longer for slow responses, and set -f so Hydra stops against a host once it recovers a working pair. Lower -t on brittle SSH or HTTP forms to reduce lockouts.

Is Hydra offline hash cracking?

No. Hydra is an online cracker that authenticates against a live service over the network. To crack captured hashes offline, use hashcat or john instead.

When should I use Hydra instead of ffuf?

Use Hydra for multi-protocol network logins (SSH, FTP, SMB, and HTTP form modules). Use ffuf when the target is HTTP and you need fine-grained response matching beyond Hydra http-post-form failure strings.

Updated Jul 15, 2026

Passwords

Test live service credentials across protocols

Parallel network login cracker for SSH, FTP, HTTP forms, and related services.

Test credential strength on a service Brute-force a web login form Replay a leaked credential dump

overview

What Hydra does

Hydra throws username and password guesses at a live service until a pair authenticates. It covers SSH, FTP, SMB, HTTP form auth, and many other modules from one CLI.

Feed -L and -P lists, a -C login:pass dump, or -x charset generation. Tune -t per target and set -f to exit once a host yields a hit, so lockouts stay bounded.

Trickest runs Hydra as a managed Passwords node: target plus credential files in, FILE and FOLDER of recovered pairs out. Prefer hashcat or john for offline hashes. Prefer ffuf when HTTP response matching must be precise.

source github.com/vanhauser-thc/thc-hydra

use cases

Where Hydra fits

Test credential strength on a service

Run a username and password list against SSH, FTP, SMB, or an HTTP login to confirm whether weak or reused credentials grant access.

Brute-force a web login form

Use the http-post-form service to test a phpMyAdmin panel, admin console, or app login, matching the failure string so Hydra reports only the pairs that authenticate.

Replay a leaked credential dump

Feed a colon-separated login:pass file so Hydra replays known leaked pairs directly against the target service.

Brute force when you have no list

Use the built-in generator to try a charset and length range, with non-random ordering to make the run repeatable.

Spray across many hosts

Supply a servers file to attack a list of targets, tuning global and per-target concurrency to stay within their limits.

reference

Hydra inputs and flags

31 inputs

Name	Type	Flag	Description
server	STRING	·	The target: a DNS name, IP, or CIDR such as 192.168.0.0/24.
service	STRING	·	The service to crack, e.g. ssh, ftp, smb, or http-post-form.
login	STRING	-l	Try a single login name.
logins	FILE	-L	Load several logins from a file.
passwords	FILE	-P	Load several passwords from a file.
login-pass-file	FILE	-C	Colon-separated login:pass file instead of separate username and password lists.
threads-per-target	STRING	-t	Connections to run in parallel per target (default 16).
exit-found	BOOLEAN	-f	Exit when a login/pass pair is found for a host.

Showing key inputs. Hydra exposes 31 inputs in total.

Full flag reference (31 inputs)

Name	Type	Flag	Description
ipv4	BOOLEAN	-4	use IPv4 addresses (default)
ipv6	BOOLEAN	-6	use IPv6 addresses (always wrap in [], including in the servers file)
port	STRING	-s	connect on this port when the service runs on a non-default one
debug	BOOLEAN	-d	debug mode
login	STRING	-l	try this single login name
quiet	BOOLEAN	-q	do not print messages about connection errors
logins	FILE	-L	load several logins from a file
server	STRING	·	the target: a DNS name, IP, or CIDR such as 192.168.0.0/24 (this or the servers file)
old-ssl	BOOLEAN	-O	use old SSL v2 and v3
servers	FILE	-M	list of servers to attack, one per line, ':' to set a port
service	STRING	·	the service to crack. Supported: adam6500 asterisk cisco cisco-enable cvs ftp[s] http[s]-{head\|get\|post} http[s]-{get\|post}-form http-proxy http-proxy-urlenum icq imap[s] irc ldap2[s] ldap3[-{cram\|digest}md5][s] mssql mysql(v4) nntp oracle-listener oracle-sid pcanywhere pcnfs pop3[s] redis rexec rlogin rpcap rsh rtsp s7-300 sip smb smtp[s] smtp-enum snmp socks5 ssh sshkey teamspeak telnet[s] vmauthd vnc xmpp
verbose	BOOLEAN	-v	verbose mode
password	STRING	-p	try this single password
passwords	FILE	-P	load several passwords from a file
exit-found	BOOLEAN	-f	exit when a login/pass pair is found for a host
pass-gen-nsr	STRING	-e	extra password tries: 'n' null password, 's' login as pass, 'r' reversed login
output-format	STRING	-b	output format: text (default), json, or jsonv1
threads-global	STRING	-T	run this many connects in parallel overall (default 64)
login-pass-file	FILE	-C	colon-separated login:pass file instead of separate login and password files
pass-generation	STRING	-x	MIN:MAX:CHARSET bruteforce generation, e.g. 5:8:A1 for length 5 to 8 with uppercase letters and digits
show-login-pass	BOOLEAN	-V	show login+pass for each attempt
dont-redo-failed	BOOLEAN	-K	do not redo failed attempts (good for mass scanning with a servers file)
exit-found-global	BOOLEAN	-F	exit when any login/pass pair is found across all hosts
loop-arround-users	STRING	-u	loop around users rather than passwords (implied with -x)
threads-per-target	STRING	-t	run this many connects in parallel per target (default 16)
pass-gen-non-random	BOOLEAN	-r	use a non-random shuffling method for option -x
perform-ssl-connect	BOOLEAN	-S	perform an SSL connect
wait-time-per-login	STRING	-c	wait time per login attempt over all threads (forces one thread per target)
wait-time-for-response	STRING	-w	wait time for a response (default 32)
pass-gen-disable-symbols	BOOLEAN	-y	disable use of symbols in bruteforce
wait-time-between-connects	STRING	-W	wait time between connects per thread (default 0)

example

Run Hydra

Hydra · command

# brute-force an SSH login with username and password listshydra -L users.txt -P passwords.txt -t 4 -f ssh://198.51.100.23

sample output

Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - for legal and authorized testing only Hydra starting at 2026-06-22 14:03:11[DATA] max 4 tasks per 1 server, overall 4 tasks, 3210 login tries (l:6/p:535), ~803 tries per task[DATA] attacking ssh://198.51.100.23:22/[22][ssh] host: 198.51.100.23   login: admin   password: s3cret-Summer24[STATUS] 1210.00 tries/min, 1210 tries in 00:01h, 2000 to do in 00:02h, 4 active1 of 1 target successfully completed, 1 valid password foundHydra finished at 2026-06-22 14:05:47

guidance

Choosing Hydra

Reach for Hydra when you need authorized online login testing across protocols. Use hashcat or john for offline hashes. Prefer ffuf when an HTTP login needs tight response matching.

medusa

Parallel network login cracker with a different module set and tuning model.

ncrack

Nmap network auth cracker. Strong on SSH and RDP; fewer modules than Hydra overall.

ffuf

Web fuzzer with response matching. Better when HTTP login brute force needs precise filters.

faq

Hydra questions

Point Hydra at the web host and use the http-post-form service, then give it the login path, the POST body with ^USER^ and ^PASS^ placeholders, and a failure string. A phpMyAdmin form uses pma_username and pma_password, for example http-post-form "/phpmyadmin/index.php:pma_username=^USER^&pma_password=^PASS^:F=Cannot log in". On Trickest the path, body, and failure string go into the service input.

Run Hydra yourself

A target and a credential wordlist feed Hydra, which tests logins in parallel and writes the working login/pass pairs as a queryable output.

Open Hydra in the library Build a workflow with it

Facts on this page come from the live Trickest tool library.