Hash cracker (dictionary)
Recover the plaintext behind a weak MD5, SHA-1 or SHA-256 hash using a wordlist — the whole attack runs in your browser, so your hash never leaves your device. Bring your own rockyou.txt or use the built-in common-password list.
Built-in list: a few hundred of the most common passwords — enough for weak hashes. For depth, upload rockyou.txt or any wordlist.
What this can and can't do
This is an honest dictionary attack: it hashes each word in your list and compares. It cracks weak, unsalted MD5/SHA-1/SHA-256 — the kind you meet in CTFs or find in old data. It cannot break bcrypt, Argon2, scrypt or any salted scheme (those resist wordlists by design), and browser speed means it is for wordlists, not billion-guess brute force. Use it on hashes you are authorized to test — your own, a CTF challenge, or a sanctioned audit.
Frequently asked
Why is my hash safer here than on other crack sites?
Most 'reverse hash' sites make you upload your hash to their server and check it against a giant database. Here the wordlist is downloaded to your browser and the hashing happens locally — your hash is never sent anywhere. That matters when the hash itself is sensitive.
Why won't it crack bcrypt or my salted hash?
Salting and slow hashes (bcrypt, Argon2, scrypt, PBKDF2) are designed to defeat wordlist attacks — each guess is deliberately expensive and per-hash salted, so precomputation and speed don't help. That's them working as intended; this tool honestly won't pretend otherwise.
Can I use rockyou.txt?
Yes — click Upload wordlist and pick any .txt file, one candidate per line. It's read into your browser and never uploaded. Large lists take longer since the browser hashes each entry; the progress bar is honest about where it is.