CONFIGURE THE EXPERIMENT
01 / SEARCHExact text is hashed locally. Starting a search clears this field. The workers receive only the hash and the chosen search configuration.
Invented examples · each button explicitly sets the shown search options:Generated candidates: 1–24 ASCII characters. Length limits apply to numeric/brute-force phases. The dictionary uses its fixed words and optional suffixes of 0–4 digits.
Brute-force character sets
WebGPU
At most 8 useful workers; fewer can keep your device cooler.LIVE COMPUTATION
02 / MEASUREDREADY · LOCAL ONLY
- Candidates checked
- —
- Actual elapsed time
- —
- Configured search space
- —
- Currently measured · candidates/s
- —
- Estimated full search
- —
- Estimated remaining time
- —
Current strategy
—
Measured calibration candidates:
The estimate describes the full configured search, not the moment a match will appear. The original password never determines search priority. A match may arrive early, or never. Rates come from actual completed work.
PASSWORD RECOVERED
WHAT HAS ACTUALLY BEEN SEARCHED?
03 / RANGE LEDGER| Search phase | Confirmed / total | Status |
|---|
CPU and GPU share one exact index ledger. Every assigned range belongs to one engine. Counts include whole completed batches; unfinished ranges are never reported as checked.
UNDERSTAND THE EXPERIMENT
This is an offline attack on a deliberately fast, unsalted SHA-256 teaching hash. It is not an attack on a website, account or password manager. SHA-256 alone is unsuitable for modern password storage.
Salts and modern hashing
A unique salt separates each stored password hash. Argon2id deliberately adds work and memory cost. Our fast SHA-256 figures do not predict the cost of cracking properly configured Argon2id hashes.
Smart ordering
Fixed dictionary words → short numbers → word suffixes → longer numbers → selected brute-force lengths. The table shows each finite phase. Some patterns overlap across phases; no indexed range within a phase is allocated twice.
Read the guide →LONG RUNS & PRACTICAL LIMITS
No automatic 5-, 10- or 30-second cutoff. The experiment runs until a verified match, exhaustion, an engine error, or your Stop command. Pause retains the open session.
Sustained load uses battery and increases device temperature. Start with low intensity on laptops and phones. This page pauses a running search when hidden; a closed or suspended tab cannot reliably compute.
GPU mode needs a physical WebGPU adapter and support inside workers, in a secure context. Software adapters are disabled in normal use. GPU loss ends a Hybrid run explicitly; CPU work is never relabeled as GPU work.
Privacy and local cleanup
The lab has no password network endpoint and stores neither the password nor its hash in URLs or browser storage. Reset, completion and page departure terminate workers and clear practical buffers. Reveal is explicit and local. Browser extensions or compromised browser software can still observe inputs; JavaScript strings cannot be securely overwritten.