Extract an iTunes backup audit hash

Upload Manifest.plist

Select the password-protected Manifest.plist from an authorized iTunes or Finder backup. OHC uses the established itunes_backup2hashcat format and deletes the uploaded file after extraction.

Select a Manifest.plist file

No file selected Choose file

Files are processed for extraction and deleted after extraction. Maximum upload size: 100 MB.

Extracted hash or conversion output

Backup formats

Backups created by iOS versions before 10 and iOS 10 or later produce different parameter layouts. The result is compatible with Hashcat modes 14700 or 14800 for a documented audit.

Keep the original backup protected and test only with the owner’s written authorization.

iTunes backup hash formats

The extractor relies on itunes_backup2hashcat from the Hashcat project and produces hashes for Hashcat modes 14700 (iOS before 10) and 14800 (iOS 10 and later).

Backup created by iOS earlier than 10

$itunes_backup$*9*b8e3f3a970239b22ac199b622293fe4237b9d16e74bad2c3c3568cd1bd3c471615a6c4f867265642*10000*4542263740587424862267232255853830404566**

Backup created by iOS 10.x

$itunes_backup$*10*8b715f516ff8e64442c478c2d9abb046fc6979ab079007d3dbcef3ddd84217f4c3db01362d88fa68*10000*2353363784073608264337337723324886300850*10000000*425b4bb4e200b5fd4c66979c9caca31716052063

Where to find Manifest.plist

• Windows XP: C:\Documents and Settings\{user_name}\Application Data\Apple Computer\MobileSync\Backup\
• Windows 10/8/7/Vista: C:\Users\{user_name}\AppData\Roaming\Apple Computer\MobileSync\Backup\ (enable hidden files in Windows Explorer to browse it)
• macOS, all versions: ~/Library/Application Support/MobileSync/Backup/

Backup system of iTunes

A complete description is available on The iPhone Wiki.

Responsible use

Hashcat and John the Ripper are powerful and can be misused. Use them only with permission, and follow local laws and organizational security policies. Misuse can have serious legal consequences.

Credits

Credits go to philsmd and the Hashcat project.