Password Attack Simulator

Learn how password attacks work in a safe, educational environment

100% Offline Educational No Storage

Password Strength Analyzer

Analyze your password's security level with comprehensive checks

Very Weak

Entropy 0 bits

Character Set 0

Combinations 0

Character Types

Lowercase (a-z)

Uppercase (A-Z)

Numbers (0-9)

Symbols (!@#$)

Pattern Detection

Minimum Length (12+)

No Repeated Characters

No Sequential Patterns

Not a Common Word

Estimated Crack Time

Online Attack 1,000 guesses/sec

GPU Attack 100B guesses/sec

Supercomputer 100T guesses/sec

Dictionary Attack Simulation

See how attackers use wordlists to crack common passwords

Test Password

Wordlist Size

How Dictionary Attacks Work

Attackers use lists of common passwords, leaked databases, and word combinations. If your password is in any wordlist, it can be cracked instantly.

Brute Force Attack Simulation

Calculate how long it would take to crack any password by trying all combinations

Test Password

Attack Speed

Attack Type

Hash Attack Simulator

Learn how password hashes are cracked using dictionary comparison

Password to Hash

Hash Algorithm

Why MD5 and SHA-1 are Dangerous

MD5 can be cracked in seconds using rainbow tables. Always use bcrypt, scrypt, or Argon2 for password storage in real applications.

Rainbow Table & Salt Demonstration

Understand why salting passwords is crucial for security

What is a Rainbow Table?

A rainbow table is a precomputed lookup table for reversing hash functions. Attackers create these tables once and can crack any matching hash instantly.

Password MD5 Hash

password 5f4dcc3b5aa765d61d8327deb882cf99

123456 e10adc3949ba59abbe56e057f20f883e

admin 21232f297a57a5a743894a0e4a801fc3

qwerty d8578edf8458ce06fbc5bb76a58c5ca4

... millions more ...

Try Looking Up a Hash:

How Salt Defeats Rainbow Tables

A salt is random data added to a password before hashing. The same password with different salts produces completely different hashes.

Password:

Attack Type Comparison

Attack Type Speed Effectiveness Prevention

Dictionary Very Fast High for common passwords Use unique passwords

Brute Force Slow Depends on length/charset Long passwords (16+ chars)

Rainbow Table Instant Blocked by salt Always use salted hashes

Mask Attack Medium High for patterns Avoid predictable patterns

Rule-Based Fast High for variations Don't use substitutions

Password Security Education

Learn the fundamentals of password security and cryptography

Hashing vs Encryption

Understand the difference between one-way hashing and reversible encryption

Password Entropy

How entropy measures password strength mathematically

Attack Methods

Dictionary, brute force, rainbow tables, and hybrid attacks explained

Best Practices

How to create and manage truly secure passwords

Password Entropy

Entropy measures the randomness (unpredictability) of a password, expressed in bits. Higher entropy = harder to crack.

Entropy Formula

E = log₂(C^L) = L × log₂(C)

Where: E = entropy bits, C = character set size, L = password length

Examples

abc123 6 × log₂(36) ≈ 31 bits Weak

MyP@ssw0rd! 11 × log₂(95) ≈ 72 bits Medium

correct-horse-battery-staple 28 × log₂(27) ≈ 132 bits Strong

Entropy Strength Scale

0-28

28-36

36-60

60-80

80+

Very Weak Weak Fair Strong Excellent

Password Attack Methods

Dictionary Attack

Uses lists of common passwords, words, and leaked credentials. Extremely fast for common passwords.

Speed: Instant Success: 80%+ for common passwords

Brute Force

Tries every possible combination. Guaranteed to find the password eventually, but time grows exponentially with length.

Speed: Slow to Infinite Success: 100% (given enough time)

Rainbow Table

Precomputed hash-to-password lookup tables. Instant recovery but defeated by salted hashes.

Speed: Instant Success: 0% with salt

Rule-Based Attack

Applies transformations to dictionary words: capitalize, add numbers, substitute chars (a→@, e→3).

Speed: Fast Success: High for variations

Password Best Practices

Use 16+ Characters

Length is the most important factor. Each additional character exponentially increases crack time.

Use a Password Manager

Let software generate and store unique 20+ character passwords for every site.

Enable 2FA/MFA

A second factor makes stolen passwords useless without the physical device.

Use Passphrases

"correct-horse-battery-staple" is stronger and easier to remember than "P@55w0rd!"

Don't Reuse Passwords

If one site is breached, attackers will try your password on all other sites.

Don't Use Personal Info

Birthdays, pet names, and addresses are easy to find on social media.

Don't Trust "Leet Speak"

Substituting a→@, e→3 is the first thing attackers try. It adds minimal security.

Step-by-Step: How a Password Attack Works

Obtain Hash

Attacker gains access to a database containing hashed passwords (via breach or SQL injection).

Identify Algorithm

Hash length and format reveal the algorithm (32 chars = MD5, 40 = SHA-1, 64 = SHA-256).

Load Attack Tools

Attacker loads wordlists, rules, and configures attack parameters (hashcat, John the Ripper).

Begin Cracking

Tool hashes each candidate password and compares to target. Match = password found.

Escalate Access

Cracked passwords are used to access accounts, steal data, or move laterally through systems.

📖

How to use Password Attack Simulator

This is the Password Attack Simulator utility. 100% client-side and offline capable.

Common Questions

What is the Password Attack Simulator and is it legal to use?

The Password Attack Simulator is an educational security awareness tool designed to teach students and developers how password attacks work in a safe, controlled, offline environment. It is 100% legal because it only simulates attacks on user-entered sample passwords or locally generated hashes—never on real accounts, live systems, or actual credentials. The tool helps you understand why weak passwords are dangerous and how attackers exploit them.

How does the Password Strength Analyzer work?

The Strength Analyzer evaluates your password using a scoring-based algorithm that checks: Length (12+ characters recommended), Character variety (uppercase, lowercase, numbers, symbols), Pattern detection (keyboard sequences like "qwerty", repeated characters), and Dictionary matching (comparing against common password lists). It then calculates entropy bits and provides estimated crack times for different attack scenarios (online, GPU, supercomputer).

What is a Dictionary Attack and how does the simulation work?

A Dictionary Attack tests passwords against a list of common words, leaked credentials, and frequently used passwords. Our simulator uses a built-in wordlist (100 to 10,000 common passwords) to demonstrate how attackers quickly crack weak passwords. No real network attacks occur—the tool compares hashes locally in your browser to show whether your test password would be vulnerable to this common attack method.

How does the Brute Force Attack estimation work?

The Brute Force simulation calculates how long it would take to crack your password by trying all possible combinations. Using the formula Time = (charset^length) / guesses_per_second, it estimates crack times for different attack speeds: Online (1K/sec), GPU (100B/sec), and Supercomputer (100T/sec). The tool does NOT actually try billions of combinations—it uses mathematical estimation to provide educational insights safely.

What hash algorithms are supported in the Hash Attack Simulator?

The Hash Attack Simulator supports MD5 (32 characters, deprecated due to collision vulnerabilities), SHA-1 (40 characters, considered weak), SHA-256 (64 characters, currently recommended), and SHA-512 (128 characters, strongest). You can generate hashes from any password and attempt to crack any user-entered hash using our dictionary comparison. The tool explains why MD5 and SHA-1 are no longer safe for password storage.

What is a Rainbow Table and why is salting important?

A Rainbow Table is a precomputed lookup table mapping hashes to their original passwords, enabling instant password recovery. Our demo explains this concept visually and shows why salting—adding random data to each password before hashing—defeats rainbow tables by producing unique hashes even for identical passwords. The Salt vs No Salt demonstration shows how the same password produces completely different hashes when salted.

What educational content is included in the Learn section?

The Learn section covers four key topics: (1) Hashing vs Encryption – explains why passwords should be hashed, not encrypted; (2) Password Entropy – how entropy measures strength mathematically with the formula log₂(charset^length); (3) Attack Methods – detailed breakdown of Dictionary, Brute Force, Rainbow Table, and Rule-Based attacks; (4) Best Practices – dos and don'ts including using password managers, enabling 2FA, and creating passphrases. A step-by-step walkthrough shows exactly how a real password attack unfolds.

Is my password data safe when using this tool?

100% Private & Secure. All simulations run entirely in your browser using JavaScript—nothing is ever transmitted to any server. Your test passwords, generated hashes, and analysis results remain on your device only. The tool uses no APIs, no external databases, and stores nothing permanently. Only enter sample/test passwords you create specifically for learning—never your real credentials.

Does the tool work offline?

Yes, 100% Offline. Once the page loads, all features work without internet connection. Hashing uses the browser's native Web Crypto API (for SHA algorithms) and a JavaScript implementation for MD5. Dictionary wordlists are embedded directly in the code. This makes it ideal for classroom demonstrations, security workshops, and learning environments without reliable internet.

What are the rate limiting and ethical safeguards?

The tool includes multiple safeguards: (1) Ethics Disclaimer – users must accept an "Educational Use Only" agreement before accessing the tool; (2) Rate Limiting – a 5-second cooldown between simulations prevents misuse; (3) Local-Only Processing – no ability to attack real systems; (4) Simulation Caps – limited attempts to demonstrate concepts without enabling actual attacks. These measures ensure the tool remains a learning resource, not a hacking utility.

Password Attack Simulator

Educational Use Only