🛠️ Password Safe (pwsafe)

Installation

sudo apt install pwsafe
# pwsafe2john ships with john the ripper (usually already installed)

Common Commands

CommandDescription
pwsafe2john <file>.psafe3 > hash.txtExtracts a crackable hash from a Password Safe v3 database file (.psafe3).
hashcat -m 5200 hash.txt /usr/share/wordlists/rockyou.txtCracks the master password offline (mode 5200 = Password Safe v3).
pwsafe <file>.psafe3Opens the database in the GUI client, prompting for the master password — lists every stored title/username/password entry once unlocked.

Tips & Tricks

  • A .psafe3 file found on a share/backup is exactly the kind of loot worth grabbing even without a password — the whole file is needed for pwsafe2john, not just a hash fragment, so pull the entire file off target first.
  • pwsafe is a GUI (GTK) application — on a headless attack box, run it through a forwarded X11 session or a lightweight VNC/X server rather than expecting a pure CLI workflow; there’s no first-party headless dump option.
  • Once opened, treat every entry inside as a separate credential to test — Password Safe databases used as a shared team vault commonly hold several unrelated accounts’ passwords in one file, which is exactly what turns a single cracked master password into multiple new footholds.
FileCreated
HTB - AdministratorWednesday, July 22nd 2026, 5:00:00 am

References: Password Safe - pwsafe.org