What’s new in Passware Kit 2025 v3:
- Decryption of BitLocker-encrypted devices with TPM and Preboot Execution Environment
- New rule-based attack compatible with hashcat
- Password recovery using digests instead of disk images and large files
- Password recovery for bcrypt SHA-256 hashes
- GPU-accelerated password recovery for Steganos containers
- Password recovery for Apple Notes from macOS Sequoia
- Instant decryption of FileMaker 2024 databases
- Instant Windows user and domain password removal on Windows Server 2025
What’s New Video
For your convenience, we have included a video of all the latest features of Passware Kit 2025 v3. Take a look!
BitLocker encryption has long presented a significant challenge in forensic investigations. With the release of Passware Kit 2025 v3, a streamlined solution is now available. This update allows forensic experts to decrypt BitLocker-protected devices with TPM chip in minutes. The process is supported on Windows x64 devices that use the Preboot Execution Environment (PXE).
Passware introduces a new “Apply Rules” attack, compatible with rule files from third-party tools, such as hashcat and John the Ripper. This advanced option allows the user to modify, extend, and filter passwords generated by basic password-recovery attacks, including Dictionary and Brute-force.
Passware Kit now supports digest extraction from password-protected files, allowing users to transfer the password recovery process to another machine without moving large files or disk images.
Additional enhancements in this release include support for the latest bcrypt hash algorithm; GPU acceleration for Steganos Safe; and updated password recovery and decryption for Apple Notes, FileMaker, and Windows domain users.
Decryption of BitLocker-encrypted devices with TPM and Preboot Execution Environment
Passware enables forensic investigators to decrypt BitLocker-protected devices with TPM security chip in minutes. The process works on target Windows x64 devices that use the Preboot Execution Environment (PXE). The requirements are: enabled PXE boot, two USB flash drives, an Ethernet cable (with a compatible adapter if needed), and a Windows computer running the latest version of Passware Kit Ultimate or Passware Kit Forensic with Device Decryption Add-on.
As a result, Passware Kit extracts the BitLocker VMK and Recovery key, enabling the user to decrypt the disk image.
New rule-based attack compatible with hashcat
Passware Kit introduces a new rule-based password-recovery attack that modifies password candidates using rule files compatible with third-party tools like hashcat and John the Ripper. This enables flexible and precise customization of password variations, significantly enhancing recovery efficiency.
The new “Apply Rules” attack is available as an Advanced option and can be combined with standard attacks, such as Dictionary, Brute-force, and others.
Password recovery using digests instead of disk images and large files
Passware Kit now supports digest extraction from password-protected files, allowing users to transfer the password recovery process to another computer without moving large files or disk images. Digests are small files containing only the information necessary for decryption: they include no user data and can be safely moved to a more powerful system for efficient password recovery.
Password recovery for bcrypt SHA-256 hashes
Passware Kit 2025v3 supports the new bcrypt hash algorithm: Blowfish-based SHA-256 crypt. The average recovery speed is 60 passwords per second on AMD Ryzen 9 5900X CPU.
GPU-accelerated password recovery for Steganos containers
Passware adds GPU acceleration to password recovery for Steganos Safe containers. The recovery speed now reaches 646,000 passwords per second on NVIDIA RTX 4070 Ti.
Password recovery for Apple Notes from macOS Sequoia
Passware Kit 2025 v3 is now fully compatible with macOS Sequoia, featuring support for Apple Notes created on this operating system. The update enables password recovery for individual notes protected with custom passwords, achieving speeds of up to 184,000 passwords per second on an NVIDIA RTX 4070 Ti.
Instant decryption of FileMaker 2024 databases
Passware Kit instantly decrypts FileMaker databases protected with the latest 2024 version on both Windows and Mac.
Instant Windows user and domain password removal on Windows Server 2025
Passware Kit is now fully compatible with the Windows Server 2025. It can be installed and launched on this system, and it instantly resets Windows user and domain passwords.
Passware Kit Ultimate – Air-Gapped Edition
Passware Kit Ultimate – Air‐Gapped Edition allows investigators to access data from locked mobile devices, computers, encrypted disks, and files – all with a single license, even in environments without Internet access!*
Passware Kit Ultimate includes Passware Kit Forensic, Passware Kit Mobile, Device Decryption Add-on, 10 Agents for distributed computing, and Passware Certified Examiner Online Training.
Key capabilities include:
- Password recovery for over 380 file types
- Recovery of passcodes for over 950 mobile devices
- Full disk decryption
- Decryption of BitLocker-encrypted devices with TPM and PXE
- Decryption of Macs with Apple T2 Security Chip
- Password recovery for Seagate, LaCie, and WD HDD
- Decryption of Lenovo ThinkPad with BitLocker TPM
- Live memory analysis
- Hardware acceleration on GPU
- Distributed password recovery with 10 Agents for Windows, Linux, Amazon Cloud, and Microsoft Azure
* Additional information about the Air-Gapped Edition is available upon request.