OnlineHashCrack
Operator: Operator not identified
A cloud service for recovering passwords from hashes, encrypted files and Wi-Fi captures.
Utilities
OPSEC caution
Submitted hashes, job data and recovered passwords are stored by the provider, normally for up to twelve months. It also stores the IP address and timestamp for jobs.
Product
OnlineHashCrack, a cloud service for password recovery and password audits.
Availability and source date
Active
As of: 17 October 2026.
No functionality test has been performed.
Use in OSINT research
Supports technical analysis of existing hashes or encrypted research materials. Processing runs on the provider’s GPU infrastructure.
Queries
| Input | Result | Result type |
|---|---|---|
| Password hash | The recovered password or the processing status of the password search. | Technical check according to provider |
| Document / file | Password searches for supported encrypted Office, PDF and archive files. | Technical check according to provider |
Features
- Checks password hashes using dictionaries, rules, masks and brute-force methods.
- According to the provider, supports 221 Hashcat modes, including NTLM, Kerberos, bcrypt, MD5 and SHA.
- Processes encrypted Office, PDF, ZIP, RAR and 7z files, as well as WPA/WPA2 captures.
- Provides custom dictionaries and paid GPU jobs.
- Integrates recovery jobs into other applications through a REST API and MCP.
Categories
- Utilities
Coverage
Dataset
Processes submitted hashes and files; password searches use dictionaries and configured search methods.
Access
Requirements
An account with a confirmed email address. Additional algorithms and functions may require telephone, payment or organisation verification. File uploads up to 100 MB.
Export
The REST API returns task status and JSON responses. Recovered passwords are displayed in the dashboard; the API provides a link to them.
Provider
Unknown
Country of establishment
Unknown
Interfaces
API
Limited availability. REST API v2 for jobs and status queries; an API key and appropriate account permissions are required.
MCP
Limited availability. An official MCP server with Streamable HTTP; uses the same API key as the REST API.
AI agents
Limited availability. Official MCP guides for Claude Desktop and Claude.ai; available functions depend on account authorisation.
Usage note
The provider permits jobs involving your own data, with the rights holder’s explicit permission or under another valid basis of authority.
Legal note
Limitations
- Password recovery requires an account; additional algorithms may require further verification.
- Files must not exceed 100 MB.
- GPU jobs are charged according to computing time used.
Guides and practical reports
Official · Set up the REST API and MCP
OnlineHashCrack · EN
Shows API jobs, status queries and integration with MCP clients.