cracker

GPU accelerated password cracker

Run

python hash-crack.py

You'll be prompted for which hash algorithm to crack: md5, sha1, sha224, sha256, sha384, sha512, sha3-224, sha3-256, sha3-384, sha3-512, blake2b, blake2s, ntlm, md4, plus ripemd160/sm3 if the local OpenSSL build supports them (checked automatically at startup — the prompt only ever lists formats that will actually work on your machine). ntlm and md4 use a bundled pure-Python MD4 implementation (verified against the RFC 1320 test vectors) so they work identically on every machine, regardless of whether the local OpenSSL happens to include MD4 — most modern/FIPS builds don't.

The base dictionary lives in base-passwords.txt, one password per line — edit it directly to add or remove entries; no code changes needed. It's loaded relative to the script's own location, so it's found regardless of which directory you run the tool from.

If the dictionary attack misses, you're also prompted for the brute-force character set: lowercase+digits, +uppercase, +symbols (the default — a password with any capital letter or symbol can never be found by a search that doesn't include it, no matter how long it runs), or a custom set you type in yourself. Applies to all three backends, including hashcat (a literal ? in the set is escaped automatically — hashcat's mask syntax treats ? as a macro otherwise).

Finally you choose where the target hash comes from:

1. Type a password — it's hashed right there and then cracked (the default; nothing ever leaves your machine)
2. Paste a hash you already have — e.g. from your own systems, a CTF, or an assessment you're authorized for — and it's cracked directly, no password ever typed in

Option 2 is validated against the selected algorithm's expected hex length before anything runs, and re-prompts on a bad paste instead of failing partway through.

Backends (auto-picked, fastest first)

1. hashcat/ binary, if present — GPU, any vendor, any algorithm hashcat has a mode for
2. Built-in OpenCL kernel (needs pyopencl + numpy) — GPU, any vendor, md5 only
3. Pure Python, multiprocessing across CPU cores — always available, any algorithm

If you pick a format hashcat has no mode for (or hashcat isn't installed), it falls back straight to the CPU backend — always correct, just slower than a GPU. Same for anything other than md5 on the custom GPU kernel path, which is hand-written for md5 specifically.

Runs on Windows, macOS, and Linux. The CPU backend's progress counter uses a 64-bit shared value explicitly so long brute-force runs don't silently wrap around on Windows, where Python's default "unsigned long" is only 32 bits.

Docker

docker build -t cracker .
docker run -it --rm cracker

-it is required — the tool is interactive (prompts for algorithm, charset, and target), and won't have anything to read from without it.

The image installs Linux hashcat from Debian's own package instead of the Windows hashcat.exe vendored in this repo's hashcat/ folder (which can't run in a Linux container) — same fast backend either way, nothing to configure. The custom GPU kernel isn't installed by default since it's only worth it with GPU passthrough set up on the host (see the comments at the bottom of the Dockerfile); the CPU backend works with zero setup regardless.

To use your own dictionary without rebuilding the image:

docker run -it --rm -v "$(pwd)/base-passwords.txt:/app/base-passwords.txt" cracker