3
$\begingroup$

This question already has an answer here:

I am trying to crack a SHA-256 hash but I am not sure how to approach this in an efficient way. The following is known of the original non-hashed content:

  • 64 characters long
  • only consists 0-9 and a-z (no capital letters)
  • the original content does not consist dictionary words
  • the hash is not salted

I have done some reading on the subject of cracking hashes and some information I have read is conflicting. For example, one said on a public forum that SHA-256 is virtually impossible to crack while the other said that it's a rather poor method for password storage as it could be cracked easily.

Is SHA-256 a safe method to hash passwords with (if not, what are the alternatives) and how do I crack a given hash in an efficient way (assuming the given criteria above).

Thanks in advance!

$\endgroup$

marked as duplicate by e-sushi May 28 '16 at 13:18

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • $\begingroup$ If 'does not consist of dictionary words' means 'each character random' (even mostly), no hope. If it means 'is not entirely dictionary words, but is largely words with some added dingbats and leeting and such' that's where modern password crackers like John and ocl aim and might succeed. $\endgroup$ – dave_thompson_085 May 29 '16 at 6:10
6
$\begingroup$

SHA-256 is a relatively poor way to store passwords but it is considered to be pretty much impossible to "crack". That is, retrieve the original plaintext from the hash.

The reason it is poor to use for passwords, especially without a salt, is due to the fact that it is inexpensive to compute, thus more vulnerable to brute force and rainbow tables etc.

You won't be able to crack the hash you have been provided with.

If your question is about how to securely hash passwords, consider something like PBKDF2 if you still want to use SHA256 underneath.

$\endgroup$
  • 4
    $\begingroup$ To elaborate on the "you won't be able", the password has $36^{64}$ possible values equaling $\log_2(36^{64})\approx 330$ bit key strength which is physically impossible to crack. $\endgroup$ – SEJPM May 28 '16 at 13:42

Not the answer you're looking for? Browse other questions tagged or ask your own question.