Convert a macOS plist into an audit hash

Upload an authorized plist

Use a copy of the plist from a system you are permitted to assess. The format is commonly found under /var/db/dslocal/nodes/Default/users/; the uploaded source is deleted after extraction.

Select a macOS user plist

No file selected Choose file

Files are processed for extraction and deleted after extraction. Maximum upload size: 100 MB.

Extracted hash or conversion output

Output and remediation

The result follows the plist2hashcat / mac2john convention, often beginning with $ml$. Use it to validate password policy, then reset weak credentials and retest.

macOS plist format

The extractor relies on plist2hashcat and supports plist files from macOS 10.8 (Mountain Lion) and later. The plist of a local account is located at /var/db/dslocal/nodes/Default/users/[user].plist.

macOS 10.8+ stores account credentials (PBKDF2-SHA512) in a plist file. Two tools can extract a hash from it: plist2hashcat.py and mac2john.py.

The output format is $ml$[iterations]$[salt]$[entropy], used with Hashcat mode 7100. The resulting hash can be submitted to OnlineHashCrack with the algorithm "Mac OSX 10.8+ ($ml$)". A valid macOS 10.8+ hash for mode 7100 looks like:

$ml$35460$93a94bd24b5de64d79a5e49fa372827e739f4d7b6975c752c9a0ff1e5cf72e05$752351df64dd2ce9dc9c64a72ad91de6581a15c19176266b44d98919dfa81f0f96cbcb20a1ffb400718c20382030f637892f776627d34e021bad4f81b7de8222

Responsible use

Hashcat and John the Ripper are powerful and can be misused. Use them only with permission, and follow local laws and organizational security policies. Misuse can have serious legal consequences.

Credits

Credits go to the Hashcat and John the Ripper projects.