Hashing and Password Security

You will dump password hashes long before you ever see a plaintext password. Knowing what a hash is, why salting matters, and how cracking works is what turns a line out of /etc/shadow into a working login.

Hashing is not encryption

People mix these up constantly. They are not the same operation.

• Encryption is two-way. With the key, ciphertext goes back to plaintext. It exists so authorized parties can recover the original.
• Hashing is one-way. A hash function maps input to a fixed-size digest, and there is no key and no reverse function. It exists so you can verify a value without storing it.

When you log in, the server hashes what you typed and compares it to the stored hash. It never needs your actual password on disk. A hash is deterministic (same input, same output) and avalanches (one changed character produces a completely different digest).

Why cracking works anyway

One-way does not mean uncrackable. Attackers do not reverse the hash. They guess: hash a candidate word, compare it to the target, repeat billions of times a second. Two ingredients make this fast:

• A wordlist of likely passwords (rockyou.txt is the classic starter).
• A GPU that can compute a fast hash like unsalted MD5 at enormous speed.

If everyone who picks the password password123 gets the identical MD5 hash, an attacker precomputes those once and looks them up instantly. That precomputed table is the whole point of a rainbow table.

Salting breaks the shortcut

A salt is a random value stored alongside each hash and mixed into the input before hashing. Now two users with the same password get different hashes, because their salts differ. The consequences:

• Precomputed and rainbow tables become useless, since they were built without your specific salt.
• The attacker must crack every hash separately instead of all at once.

Modern password hashes go further. Algorithms like bcrypt, argon2, and scrypt are deliberately slow and memory-hungry, so each guess costs real time. A fast hash like MD5 is a liability precisely because it is fast.

Cracking on your own box, conceptually

The two workhorse tools are hashcat (GPU) and john (John the Ripper). You feed them the hash and a wordlist, and they run the guess-and-compare loop.

The salt and slow algorithm do not stop cracking. They make it expensive, which buys defenders time and pushes attackers toward only the weakest passwords in the dump. Strong, unique passwords stay uncracked because they are not in the list.