Educational tool demonstrating dictionary and brute-force hash cracking techniques against common hash types.
Given a hash, this tool tries to recover the plaintext behind it. You choose a hash type, supply a hash (or let the tool generate one), then run a dictionary attack over a built-in list of common and leaked passwords, or a brute-force attack that generates every combination up to a short length. Each candidate is hashed and compared against the target. The surprise most people hit: cracking never reverses a hash. Every attempt is a fresh guess, so a match proves only that the password was in the tested set, and a miss proves nothing about the password's real strength.
A concrete input and expected output from the current implementation.
Input
5f4dcc3b5aa765d61d8327deb882cf99 (MD5, dictionary attack)
Expected output
Match found: password (recovered by dictionary attack)
5f4dcc3b5aa765d61d8327deb882cf99 is the MD5 hash of the string 'password'. The tool hashes each dictionary candidate with MD5 and compares the result to the target; 'password' appears on any common-password list, so the dictionary sweep ends with a match.
The dictionary attack hashes every entry in a built-in list of common, reused, and previously leaked passwords using the selected algorithm, and compares each result to the target hash. A counter tracks how many candidates have been tried, and the search stops at the first match or when the list runs out. If the list is exhausted without a match, the password is simply not in the list.
Brute force abandons the wordlist. The tool generates every combination over a chosen alphabet (for example lowercase letters plus digits), starting at one character and growing in length, hashing and comparing each one exactly as the dictionary attack does. Candidate count grows exponentially, so the work roughly multiplies by the alphabet size for every extra character. That is why the search stops after a few characters: longer passwords make it take effectively forever.
No. It only recovers plaintexts that sit in its dictionary or fit inside its short brute-force length limit, which is exactly the lesson: real cracking succeeds against weak choices, not arbitrary ones. If the search gives up, that tells you nothing about the password except that it was not among the tested candidates.
No to both. The search runs entirely in your browser: the tool generates its own candidates and compares them locally, so nothing is uploaded and no system is touched. The target hash exists only in your session. The tool demonstrates the technique, and gives you the vocabulary to judge real cracking tools without running them.
The example and behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Interactive periodic table - click elements, enter quiz mode, and guess elements from their properties. Gamified learning.
Explore the periodic table with element details, properties, and category filtering.
Browse and search ASCII, Unicode, and binary character codes with copy-to-clipboard.
Test your knowledge of semantic HTML elements with quizzes and best-practice tips.
Structured typing lessons with finger placement guide. Track WPM improvement over time with localStorage persistence.
Timed multiplication drills with accuracy tracking per table (1-12). Progress chart saved across sessions.