I am trying to crack a SHA-256 hash but I am not sure how to approach this in an efficient way. The following is known of the original non-hashed content:

  • 64 characters long
  • only consists 0-9 and a-z (no capital letters)
  • the original content does not consist dictionary words
  • the hash is not salted

I have done some reading on the subject of cracking hashes and some information I have read is conflicting. For example, one said on a public forum that SHA-256 is virtually impossible to crack while the other said that it's a rather poor method for password storage as it could be cracked easily.

Is SHA-256 a safe method to hash passwords with (if not, what are the alternatives) and how do I crack a given hash in an efficient way (assuming the given criteria above).

Thanks in advance!

  • $\begingroup$ If 'does not consist of dictionary words' means 'each character random' (even mostly), no hope. If it means 'is not entirely dictionary words, but is largely words with some added dingbats and leeting and such' that's where modern password crackers like John and ocl aim and might succeed. $\endgroup$ Commented May 29, 2016 at 6:10

1 Answer 1


SHA-256 is a relatively poor way to store passwords but it is considered to be pretty much impossible to "crack". That is, retrieve the original plaintext from the hash.

The reason it is poor to use for passwords, especially without a salt, is due to the fact that it is inexpensive to compute, thus more vulnerable to brute force and rainbow tables etc.

You won't be able to crack the hash you have been provided with.

If your question is about how to securely hash passwords, consider something like PBKDF2 if you still want to use SHA256 underneath.

  • 8
    $\begingroup$ To elaborate on the "you won't be able", the password has $36^{64}$ possible values equaling $\log_2(36^{64})\approx 330$ bit key strength which is physically impossible to crack. $\endgroup$
    – SEJPM
    Commented May 28, 2016 at 13:42
  • 1
    $\begingroup$ I will state that its pretty easy to use a dictionary to determine a hash. Password123 hashed (unsalted) will produce a consistent hash and you could deduce a password that way. $\endgroup$ Commented Jun 26, 2021 at 22:21
  • $\begingroup$ So the key point is to salt it, not "avoid using sha-2" $\endgroup$
    – JoelBonetR
    Commented Apr 30, 2022 at 16:11

Not the answer you're looking for? Browse other questions tagged or ask your own question.