VNC Hash

Technical details, regex signatures, and cracking commands for the VNC algorithm.

Regex Identification Signature:
^\$vnc\$\*[a-f0-9]{32}\*[a-f0-9]{32}$
Not supported natively by Hashcat
John the Ripper Command:
← Back to Hash Identifier

What is VNC?

The **VNC (Virtual Network Computing) hash format**, technically referred to as the **RFC 2832 "VNC password" hash**, is not a standalone cryptographic algorithm but rather a legacy password storage scheme derived from the **DES-based Unix password hashing mechanism** (specifically, the **MD5-based "crypt" variant** with a salt prefix). Originating in the mid-1990s as part of the VNC remote desktop protocol (RFC 4482), this format encodes passwords as a **64-character hexadecimal string** structured as `0000000000000000000000000000000

Identifying VNC Hashes

Identifying a hash blindly is often difficult because multiple algorithms can output strings of the exact same length. For example, a standard 32-character hexadecimal string could be MD5, NTLM, MD4, or LM. To definitively identify VNC, security researchers analyze the hash against a strict regular expression (regex) signature (shown above) to find structural matches.

How to Crack VNC

If you need to recover the plaintext password for a VNC hash during a penetration test or forensics investigation, you must supply the correct module ID to your cracking software. Use the exact commands provided at the top of this page to target the hash successfully.