CrackStation
Operator: Defuse Security / Taylor Hornby
Free online lookup of unsalted password hashes against precomputed tables for MD5, SHA and other formats.
Utilities
OPSEC caution
During a hash query, the server sends the user’s IP address to Google together with the CAPTCHA response.
Product
CrackStation, a free online hash lookup service.
Availability and source date
Active
As of: 17 October 2026.
No functionality test has been performed.
Use in OSINT research
Looks up unsalted password hashes in existing tables and displays matching plaintexts. A utility for analysing hashes already available.
Queries
| Input | Result | Result type |
|---|---|---|
| Password hash | Hash format and matching plaintext from the stored lookup tables, where available. | Technical check according to provider |
Features
- Processes up to 20 unsalted hashes per query.
- Supports formats including MD5, NTLM, SHA-1 and SHA-2.
- Searches precomputed tables rather than running a brute-force attack.
- Provides the associated word list as a separate download.
Categories
- Utilities
Coverage
Dataset
Precomputed hash-to-plaintext tables. The provider states 15 billion entries for MD5/SHA-1 and 1.5 billion for other hash formats.
Access
Requirements
Public browser page without an account; hash queries require reCAPTCHA.
Export
Results displayed in the browser. The separate word list is available as a compressed text file.
Provider
Defuse Security / Taylor Hornby
Country of establishment
Unknown
Interfaces
No API, MCP or AI integration is documented.
Maintenance
Licence
AGPL-3.0
Latest activity
Commit 09/2026
Stars
1 (as of 17 October 2026)
Legal note
Limitations
- The online lookup supports only unsalted hashes in the listed formats.
- Each query can contain a maximum of 20 hashes; reCAPTCHA is required.
Guides and practical reports
Official · CrackStation: how it works
EN
Explains hash lookups, lookup tables and supported limits using examples.