> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/creds/offline-attacks/online-hash-databases.md).

# Online hash databases

Instead of cracking the hashes yourself you can use the following online hash databases to see if the hash is already known and cracked

## CrackStation

Reference: <https://crackstation.net/>

You can test/crack **up to 20 hashes at a time** with CrackStation.

CrackStation uses massive pre-computed lookup tables to crack password hashes. These tables store a mapping between the hash of a password, and the correct password for that hash. The hash values are indexed so that it is possible to quickly search the database for a given hash. If the hash is present in the database, the password can be recovered in a fraction of a second. This only works for "unsalted" hashes. For information on password hashing systems that are not vulnerable to pre-computed lookup tables

Crackstation's lookup tables were created by extracting every word from the Wikipedia databases and adding with every password list we could find. We also applied intelligent word mangling (brute force hybrid) to our wordlists to make them much more effective. For MD5 and SHA1 hashes, we have a 190GB, 15-billion-entry lookup table, and for other hashes, we have a 19GB 1.5-billion-entry lookup table.

You can download CrackStation's dictionaries [here](https://crackstation.net/crackstation-wordlist-password-cracking-dictionary.htm).

## GromWeb

References:

* <https://md5.gromweb.com/>
* <https://sha1.gromweb.com/>

## Hashes.com

Reference: <https://hashes.com/en/decrypt/hash>

You can test/crack **up to 25 hashes at a time** with Hashes.com.

Hashes.com is a hash lookup service. This allows you to input an MD5, SHA-1, Vbulletin, Invision Power Board, MyBB, Bcrypt, Wordpress, SHA-256, SHA-512, MYSQL5 etc hash and search for its corresponding plaintext ("found") in our database of already-cracked hashes.

It's like having your own massive hash-cracking cluster - but with immediate results!

We have been building our hash database since August 2007.

We are not cracking your hash in realtime - we're just caching the hard work of many cracking enthusiasts over the years.