A Python cybersecurity tool that generates and cracks cryptographic hashes using dictionary attacks — delivered with commentary from Gandalf the Grey. Built as part of a cybersecurity learning journey.
When websites store your password they don't save it as plain text. Instead they run it through a hash function which converts it into a fixed string:
"gandalf" → "ab17850978e36aaf6a2b8808f1ded971"
Hashing is a one-way process — you can't reverse a hash back to the original password. So how do hackers crack them? By hashing millions of common passwords and comparing the results. This is called a dictionary attack.
| Feature | Description |
|---|---|
| Hash Generator | Generate MD5, SHA1, SHA256, or SHA512 hashes from plain text |
| Hash Cracker | Crack hashes using a wordlist dictionary attack |
| Auto Detection | Automatically identifies hash type from its length |
| Wordlist Support | Works with any wordlist — swap in millions-word lists for real cracking |
| Gandalf Mode | In-character reactions from Gandalf for every operation |
| Algorithm | Length | Security |
|---|---|---|
| MD5 | 32 chars | ❌ Broken — never use for passwords |
| SHA1 | 40 chars | |
| SHA256 | 64 chars | ✅ Strong — widely used |
| SHA512 | 128 chars | ✅ Very strong — maximum security |
python hashcracker.py- Enter plain text (e.g. "gandalf")
- Select hash type (MD5, SHA1, SHA256, SHA512)
- Copy the generated hash
The included wordlist.txt contains common passwords for testing including
LOTR themed passwords. For real-world testing, replace it with larger
wordlists like:
- rockyou.txt — 14 million real leaked passwords, industry standard
- SecLists — massive collection maintained by Daniel Miessler on GitHub
- CrackStation — 1.5 billion word wordlist for serious cracking
- Cryptographic hashing — one way functions that can't be reversed
- Hash length detection — every algorithm always produces the same length output
- Dictionary attacks — hashing wordlist entries and comparing to target
- Why MD5 is dangerous — designed for speed, making it easy to crack at scale
- Real tools — this is a simplified version of Hashcat and John the Ripper
- Defense — why bcrypt and Argon2 are better for passwords (intentionally slow)
This tool is intended for educational purposes only. Only use on hashes you own or have explicit permission to crack. Unauthorized cracking of credentials is illegal.
A growing Python cybersecurity toolkit:
| Tool | Purpose |
|---|---|
| Hash Cracker | Crack MD5/SHA hashes via dictionary attack |
| Password Checker | Analyze password strength |
| Port Scanner | Find open ports on a host |
| Ping Sweeper | Discover live hosts on a network |
| Caesar Cipher | Encrypt and decrypt messages |
Ryan — github.com/Patharx
"All secrets yield to knowledge and patience." 🧙