I recently created a program that hashes a password using SHA256 and potentially using salt. How can I crack that if I know that the password only contains lowercase letters?

  • 2
    $\begingroup$ rainbow tables, dictionary attack, brute force; the first think you need to figure out is if it uses a salt. that will be important. $\endgroup$
    – mikeazo
    Jul 9, 2015 at 20:19
  • 1
    $\begingroup$ Especially if you don't know the salt and/or pepper :) You should also know / guess the character encoding. $\endgroup$
    – Maarten Bodewes
    Jul 9, 2015 at 20:27

1 Answer 1


Let us ignore all kinds of encoding or protocol details. We are looking for some string such that $yourprogram(string)=h$, where $h$ is a specific hash value. You will try to crack that password, rather than SHA-256.

Let us assume that all the possible messages you have are the 26 lowercase letters of English alphabet. That means that, for every letter in your password, you would multiply by 26 the amount of possible passwords. For instance, there are $26^{10}$ passwords of 10 letters. Then, if you try to brute force (try every possible solution until you hit the jackpot), it would be enough to use a longer password to prevent your attack. Sure: it would be longer than a password with a longer character set (uppercase, numbers, special characters), but it could be somehow manageable.

The problem is that humans are very bad at producing and remembering randomness. The fact that we are discussing this issue occurs mostly because "hquekl" is, despite being meaningless (to me, at least), easier to remember and communicate than "a{çè_". Which means that most passwords are likely to be "words". A word, in this sense, is a broad term, since it is just a string that we can remember. It can be an English word (password), a Spanish word (clave), a pattern (qweqweqwe), an English word backwards (drowssap) or a phrase (iloveyou). Some languages have a name for the word "dictionary" that can be roughly translated as "wordbook". As an attacker, this is the goal: collect the sets of words that compose the most likely passwords and create a list. Now, as an attacker, using a dictionary makes your job easier.

If you do not use salt, your scheme will be victim of determinism. Let us say that (for a very innocent hash algorithm) $hash(password)=5$. You do not know the value of $password$, but you steal a list of password hashes and see several entries of $5$. Not only that increases the likelihood of $password$ being in a dictionary: that means that several users have the same password. Furthermore, you can check a rainbow table: a gigantic list of precomputed hashes. Maybe someone already found out a value of $password$ that hashes to $5$, and even the dictionary attack will be unnecessary.

If you use salt, keep in mind that the value of salt is intended to be considered public, but has to be long enough. You can always make it difficult to the attacker, by asking increasing long passwords and blacklisting passwords that can be found in a dictionary. But you will make it even more difficult for your legitimate users.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.