crypto_hash_cracker
Read-onlyIdempotent
Crack password hashes via dictionary attack to recover plaintext passwords. Test hashes against a custom wordlist or built-in common passwords for security auditing.
Instructions
Hash cracker (dictionary attack). Recover the plaintext behind a password hash by testing it against a wordlist — a supplied dictionary and/or a built-in common-password list. Use it to audit weak hashes; run crypto_hash_identifier first if the algorithm is unknown, and crypto_password_strength to score a password you already have. Runs locally on the input you provide: read-only, non-destructive, contacts no external service, and is rate-limited. Returns whether a match was found, the recovered password, the detected hash type, the number of attempts, and the elapsed seconds.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| hash | Yes | The hash string to crack, e.g. an MD5/SHA/bcrypt digest. | |
| type | No | Hash algorithm. Leave as "auto" to detect it from the hash length/format, or set it explicitly to skip detection. | auto |
| dictionary | No | Optional custom candidate passwords to try first, in order. Combined with the built-in list when useCommonPasswords is true. | |
| useCommonPasswords | No | Also test a built-in list of the most common passwords. Disable to test only the supplied dictionary. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| hash | No | The input hash, echoed back. | |
| type | No | Hash algorithm used or detected ("unknown" if undetectable). | |
| found | No | Whether a candidate password matched the hash. | |
| password | No | The recovered plaintext password, or null when not found. | |
| attempts | No | Number of candidate passwords tested. | |
| duration | No | Elapsed wall-clock time in seconds (rounded to 3 decimals). |