🔓 Hash Cracker - Dictionary Attack Tool

🔐
🎯
📚
{{ result.found ?'✅' :'❌' }}
Hash Type: {{ result.type.toUpperCase() }}
Password: {{ result.password }}
Attempts: {{ result.attempts.toLocaleString() }}
Duration: {{ result.duration }}s
Speed: {{ getSpeed() }} hashes/sec
🧪
{{ example.hash }}
💡
  • The tool automatically detects most hash types
  • Add your own word list for targeted attacks
  • bcrypt hashes are slow to crack by design
  • Longer passwords exponentially increase cracking time
  • This is a dictionary attack - it won't find random passwords
⚠️

ℹ️ About Hash Cracker

Hash Cracker tests candidate passwords against a supplied hash and reports a match when one candidate produces the same digest or password-hash value. This is a dictionary attack tool, not decryption: secure one-way hashes are designed so the original password cannot be mathematically reversed.

Use it for authorized password-audit training, incident-response triage on hashes you own, validating whether a sample password appears in a small word list, or demonstrating why reused and common passwords fail quickly. Paste a hash, choose the detected or known type, and optionally add targeted candidates such as company terms, test account passwords, or lab word lists.

Supported hash formats:

  • MD5: 32 hexadecimal characters, such as 5d41402abc4b2a76b9719d911017c592; useful for legacy checks only and unsuitable for password storage.
  • SHA-1: 40 hexadecimal characters, such as aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d; a legacy digest format with known collision weaknesses.
  • SHA-256, SHA-384, and SHA-512: 64, 96, and 128 hexadecimal characters respectively; strong digest algorithms, but still fast and unsalted when used directly as password hashes.
  • bcrypt: modular crypt strings beginning with $2a$, $2b$, $2x$, or $2y$; salted and deliberately slow, so small dictionaries may be practical while broad cracking is expensive.
  • Unix crypt variants: $1$ for MD5 Crypt, $5$ for SHA-256 Crypt, and $6$ for SHA-512 Crypt.

Example workflow: if you enter the MD5 hash 5d41402abc4b2a76b9719d911017c592 and include hello in the dictionary, the tool can identify hello as the matching plaintext. If the password is random, long, salted with an unsupported scheme, or absent from the dictionary, the result should be treated as "not found", not as proof that the password is safe.

Important limitations:

  • Automatic type detection uses visible hash syntax and length, so ambiguous raw hex strings may need a manual type selection.
  • The built-in dictionary is intentionally small; meaningful audits need permission and a scoped, relevant candidate list.
  • Modern password storage should use salted, work-factor or memory-hard schemes such as Argon2id, bcrypt, scrypt, or PBKDF2 rather than raw MD5, SHA-1, or SHA-2.
  • Hashes and dictionaries are submitted to the server API for processing, so do not paste production secrets unless you are allowed to disclose them to this service.

References: MD5 is specified in RFC 1321; SHA-1 and the SHA-2 family are specified by NIST FIPS 180-4; bcrypt comes from the USENIX paper A Future-Adaptable Password Scheme. For defensive password-storage guidance, see the OWASP Password Storage Cheat Sheet and NIST SP 800-63B.

Legal notice: Use this tool only for education, lab work, and security testing where you have explicit permission to test the hashes.

API Usage Example:

POST /api/tools/crypto/hash-cracker
Content-Type: application/json

{
    "hash": "5d41402abc4b2a76b9719d911017c592",
    "type": "auto",
    "useCommonPasswords": true,
    "dictionary": [
        "password",
        "admin",
        "test"
    ]
}
Ready