Hashing fundamentals · Crack the challenge · Salting defence
This project explores how cryptographic hashing works, where it breaks down, and how defenders use salting to close the gap. As cyber threats grow, understanding these fundamentals is essential for anyone building or auditing secure systems.
Hashing underpins password storage, digital signatures, and data integrity checks across virtually every modern application. Getting it wrong — weak algorithms, no salting — opens the door to rainbow table and collision attacks.
This project covers
The same input always produces the same hash output — every single time, on any machine.
Computationally infeasible to find two different inputs that produce the same hash value.
Given a hash, it should be practically impossible to reverse-engineer the original input.
Even a single-character change in input produces a completely different output hash.
Hashing is not encryption — there is no key, and the process is designed to be one-way. Its role is verification, not secrecy.
| Algorithm | Output length | Speed | Status | Notes |
|---|---|---|---|---|
| MD5 | 128-bit | Very fast | Weak | Vulnerable to collision attacks. Avoid for security-critical use. |
| SHA-1 | 160-bit | Fast | Deprecated | Collision demonstrated in 2017. Being phased out across the industry. |
| SHA-256 | 256-bit | Moderate | Recommended | Part of the SHA-2 family. Current industry standard for most use cases. |
| bcrypt | Variable | Intentionally slow | Recommended | Purpose-built for passwords. Cost factor scales with hardware improvements. |
The following is an MD5 hash of a very common password. Can you identify the plaintext?
Hint: it's one of the most commonly used passwords in the world.
This demonstrates why MD5 is unsuitable for password storage — the hash above can be found in any publicly available rainbow table within milliseconds.
Two users with the same password produce identical hashes. An attacker who obtains the hash database can use a precomputed rainbow table to crack every matching password simultaneously.
A random value (the salt) is appended to the password before hashing. Even identical passwords produce unique hashes, making precomputed attacks useless.
The salt is stored alongside the hash in plain text — its job is not secrecy, but uniqueness. It forces attackers to crack each hash individually rather than in bulk.