# How to crack SHA256 only letters

I recently created a program that hashes a password using SHA256 and potentially using salt. How can I crack that if I know that the password only contains lowercase letters?

• rainbow tables, dictionary attack, brute force; the first think you need to figure out is if it uses a salt. that will be important. Jul 9, 2015 at 20:19
• Especially if you don't know the salt and/or pepper :) You should also know / guess the character encoding. Jul 9, 2015 at 20:27

Let us ignore all kinds of encoding or protocol details. We are looking for some string such that $yourprogram(string)=h$, where $h$ is a specific hash value. You will try to crack that password, rather than SHA-256.
Let us assume that all the possible messages you have are the 26 lowercase letters of English alphabet. That means that, for every letter in your password, you would multiply by 26 the amount of possible passwords. For instance, there are $26^{10}$ passwords of 10 letters. Then, if you try to brute force (try every possible solution until you hit the jackpot), it would be enough to use a longer password to prevent your attack. Sure: it would be longer than a password with a longer character set (uppercase, numbers, special characters), but it could be somehow manageable.
If you do not use salt, your scheme will be victim of determinism. Let us say that (for a very innocent hash algorithm) $hash(password)=5$. You do not know the value of $password$, but you steal a list of password hashes and see several entries of $5$. Not only that increases the likelihood of $password$ being in a dictionary: that means that several users have the same password. Furthermore, you can check a rainbow table: a gigantic list of precomputed hashes. Maybe someone already found out a value of $password$ that hashes to $5$, and even the dictionary attack will be unnecessary.