cyberchef_hash_crack
Read-onlyIdempotent
Recover plaintext passwords from fast unsalted hashes using a wordlist, with built-in common passwords and mutations. Refuses slow hashes like bcrypt to avoid false confidence.
Instructions
Recover the plaintext behind a fast unsalted hash from a wordlist: MD5, SHA-1, SHA-256/384/512 and NTLM. Follows hash_identify with the question that matters — is this password one anybody would guess? Deliberately REFUSES bcrypt, scrypt, Argon2, yescrypt and the crypt(3) family BY NAME rather than attempting them, because a pure-JS attempt would find nothing and imply the password was strong. Supply a wordlist; a small common-password list and cheap mutations are built in. Bounded to 20 seconds, about 24 million candidates.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| hashes | Yes | The hashes, as hex. Several share one pass over the wordlist. | |
| wordlist | No | Candidates to try, in order. The built-in common list runs first. | |
| algorithm | No | Which digest. `auto` infers it from the hex length and tries every candidate when that is ambiguous, as it is at 32 characters. | auto |
| mutations | No | Capitalise, uppercase, append a digit or year, leetspeak. About 20x the search. | |
| include_common | No | Try the built-in list of the most-used passwords first. |