HackBlue

Labs / Identity and access

Password hashing and salting visualizer

See what a leaked user table reveals with no salt, one site-wide salt, and per-account salts, using real SHA-256 hashes computed in your browser.

  • Interactive lab
  • Beginner
  • 5 steps
  • 0 of 5 solved

Goal

A copy of the user table has leaked. Eight accounts are shown with their passwords so you can see what the attacker cannot: who chose the same password and who chose a common one.

Switch between storage schemes and watch what the stolen hashes reveal. You can also type a password of your own to add a ninth account. Hashes are computed in your browser and never sent anywhere.

Storage scheme

Shared hashes
5 accounts
Table hits
6 instantly
Attacker work
0 hashes for a 12-word list
Stolen tablestored = SHA-256(password)
AccountStored valuePrecomputed table
anapassword: Summer2026!a5c95e887dbf1c0a49fd01bced847d64a1a134ec2a7d09332c85d361aeb0f9b8
same as 2 others		cracked: Summer2026!
benpassword: password10b14d501a594442a01c6859541bcb3e8164d183d32937b851835442f69d5c94e
same as 1 other		cracked: password1
chenpassword: Summer2026!a5c95e887dbf1c0a49fd01bced847d64a1a134ec2a7d09332c85d361aeb0f9b8
same as 2 others		cracked: Summer2026!
danapassword: correct horse battery staplec4bbcb1fbec99d65bf59d85c8cb62ee2db963f0fe106f483d9afa73bd4e39a8ano match
elipassword: Summer2026!a5c95e887dbf1c0a49fd01bced847d64a1a134ec2a7d09332c85d361aeb0f9b8
same as 2 others		cracked: Summer2026!
fatimapassword: lab-only-Vq8#tR2mdaa405b8728734519597183330c120531a2c2d11978bde6b77995c8ec75fbfe1no match
guspassword: password10b14d501a594442a01c6859541bcb3e8164d183d32937b851835442f69d5c94e
same as 1 other		cracked: password1
hanapassword: letmein1c8bfe8f801d79745c4631d09fff36c82aa37fc4cce4fc946683d7b336b63032cracked: letmein

5 accounts share a stored hash and 6 fall to the precomputed table.

Steps

  1. 01Pick a storage scheme where no two accounts share a stored hash and the attacker’s precomputed table cracks nothing instantly.

    Do this in the workbench above. This step completes itself when the condition is met.

  2. 02With no salt, how many accounts share the most common stored hash?

  3. 03A single site-wide salt defeats the precomputed table. Why is it still weak?

  4. 04With per-account salts, how many hash computations does the attacker need to try the 12-word list against all 8 accounts?

  5. 05Even with per-account salts, six accounts use passwords from the attacker’s list. What protects them?