Yes, tools like John the Ripper and Hydra are legal to use for legitimate purposes, such as testing the strength of your own passwords or conducting authorized security assessments. Unauthorized use against systems you don't own or don't have explicit permission to test is illegal.