Cracking hashes

In a nutshell Passwords aren't stored as text — they're stored as hashes, one-way fingerprints. You can't reverse a hash, but you can guess: hash a candidate word and see if it matches. That's password cracking. John the Ripper and hashcat do it — fast, offline, against a stolen hash.

Why hashes exist, and why they still crack

A hash function turns any input into a fixed-size string, one-way: easy forwards (password → 5f4dcc3b…), impossible backwards. A site stores the hash; at login it hashes what you typed and compares. Even if the DB leaks, there are no plaintext passwords.

The catch: the same input always gives the same hash. So a thief hashes a huge list of likely passwords and looks for matches. Nothing is reversed — it's a fast game of matching fingerprints.

Analogy — a fingerprint at a crime scene. You can't rebuild a face from a print (one-way). But you can fingerprint a big list of suspects and find the match. Cracking is running the suspect list.

Salt — why identical passwords look different

Two users both pick password → naive hashing gives the same hash, crackable at once and vulnerable to precomputed rainbow tables. A salt is a random per-user value added before hashing:

alice: password + salt_a  →  hash_a
bob:   password + salt_b  →  hash_b     ← same password, different hash

Now precomputed tables are useless and each hash must be attacked individually. A hash without a salt is a serious weakness.

Length beats complexity — the reason in one chart

For an offline attack on a fast hash, each extra character multiplies the work far more than a symbol does:

The two tools & attack modes

john --wordlist=rockyou.txt hashes.txt      # versatile, auto-detects hash type (CPU)
john --show hashes.txt
hashcat -m 0 -a 0 hashes.txt rockyou.txt    # GPU speed; -m 0 = MD5, -a 0 = wordlist