Password Cracking Lab
Four hashed passwords, one wordlist. See exactly which ones fall to a dictionary attack and which survive it — and why.
Four hashed passwords and one wordlist. Watch which fall immediately and which survive — and understand precisely why, because the reason is the whole of password security in one demonstration.
How to use it
- Run the wordlist against the hashes.
- See which crack and how fast.
- Compare what survived against what did not.
What to take away
Attackers guess, they do not reverse
Cracking is hashing candidate passwords and comparing. Speed comes from the algorithm, and the candidate list comes from every previous breach.
Rules multiply a wordlist
Mangling rules turn password into P@ssw0rd, Password1 and Password2024 automatically. Predictable substitutions cost an attacker nothing.
Slow hashes are the defence
bcrypt, scrypt and Argon2 are deliberately expensive. The same rig that tries billions of SHA-256 guesses per second manages thousands against bcrypt.
Frequently asked questions
Why does a salt matter if it is stored alongside the hash?
A salt is not secret; it is unique. It stops one precomputed table cracking every user at once and forces the attacker to attack each password separately.
What makes a password survive this?
Not being in any wordlist and not being derivable by common rules. Length plus genuine unpredictability — which in practice means a password manager generated it.
Where this fits in the course
This security lab pairs with Path 00 — Absolute Basics — see all 26 learning paths.
It runs entirely in your browser: nothing is uploaded, no account is needed, and it is free.
Related
- Hash Identifier — Paste a hash and get likely algorithms, guessed from its length and character set.
- Password Policy Checker — Test a password against a configurable length/complexity policy, rule by rule.
- Kerberoasting Simulator — Request a service ticket for a weak-password service account, then crack the offline-crackable hash it hands you.
- Password Strength — Rough entropy and crack-time estimate for a password, with feedback.