Hash Cracking Simulator

Understanding Hash Cracking: How Attackers Reverse Password Hashes

When websites store passwords, they rarely save the raw text. Instead, they run the password through a cryptographic hash function — a one-way mathematical operation that transforms any input into a fixed-length string of hexadecimal characters. For example, password123 becomes 482c811da5d5b4bc6d497ffa98491e38 under MD5. Hash cracking is the process of working backwards from that digest to find the original plaintext — something hash functions are explicitly designed to make difficult.

This simulator demonstrates the three principal attack strategies used by security researchers and adversaries alike: dictionary attacks, brute-force enumeration, and rainbow table lookups. All computation runs entirely in your browser — no data leaves your machine.

Dictionary Attacks

The fastest and most effective method against real-world passwords is the dictionary attack. Attackers compile wordlists containing millions of common passwords, phrases, keyboard patterns, and leaked credentials from previous breaches. For every candidate in the list, the tool hashes it and compares the result to the target hash. Because most users choose predictable passwords, dictionary attacks succeed surprisingly often.

Modern wordlists like rockyou.txt contain over 14 million entries. Advanced tools apply rule-based mutations — capitalising the first letter, appending numbers, substituting @ for a — multiplying the effective size of the list without requiring more storage. This simulator lets you test a built-in top-20 list or paste your own wordlist to see the concept in action.

Brute-Force Enumeration

When a wordlist fails, attackers fall back to brute-force: systematically generating every possible string within a given character set and length. A six-character lowercase password has 26⁶ ≈ 308 million possibilities. Adding uppercase letters and digits raises that to 62⁶ ≈ 56 billion. With a modern GPU capable of computing billions of MD5 hashes per second, six-character passwords fall in seconds; eight-character passwords with full character sets can still be cracked within hours on a powerful rig.

In this browser-based simulator, speed is intentionally limited because JavaScript is single-threaded and lacks GPU access. The purpose is conceptual: to show how the search space grows exponentially with each additional character and how quickly simple passwords are exhausted.

Rainbow Table Lookups

A rainbow table is a precomputed data structure mapping hash values back to their original plaintexts. Construction is expensive — billions of hashes must be computed and stored — but lookups are essentially instantaneous (O(1)). This makes rainbow tables devastating against weak, unsalted hashes: given a leaked MD5 digest, an attacker can identify the plaintext in milliseconds using a pre-built table.

The rainbow table demo in this tool uses a small built-in set of common MD5 and SHA-1 mappings. You can also upload a CSV file with hash,plaintext columns to simulate a custom table lookup.

Salting: The Defender's Countermeasure

The primary defense against both dictionary attacks and rainbow table lookups is a cryptographic salt — a unique, random value concatenated with the password before hashing. Because every user gets a different salt, two users with the same password produce completely different hashes. Pre-built rainbow tables become useless, and attackers must restart their dictionary or brute-force effort for each individual hash.

Modern password-hashing algorithms — bcrypt, Argon2, and scrypt — build salting in automatically and also apply a work factor: deliberately slowing down the hash computation to make mass cracking impractical. This tool's salt field lets you see firsthand how even a short salt completely changes the hash output, breaking any precomputed lookup.

Algorithm Security

Not all hash algorithms offer the same protection. MD5 and SHA-1 were designed for speed and data integrity, not password storage. Their speed — billions of hashes per second on a GPU — makes them poor choices for passwords. SHA-256 and SHA-512 are cryptographically stronger but still fast enough to be vulnerable without proper salting and stretching. Purpose-built password hashing functions like bcrypt, Argon2, and scrypt remain the recommended approach for any production system.

Use this simulator to explore these concepts safely, understand the importance of strong hashing practices, and appreciate why password length, randomness, and proper storage algorithms are the real keys to security.