Return to Answer

Before using brute-force approaches (as covered well by others here), check whether there are direct preimage cryptanalysis attacks on the password hash algorithm used for the hashes you have - whether it has been "broken" for password hashing purposes. If it has been broken, that may be a much faster way to recover good passwords, though brute-force may still be faster for weaker passwords.

For example, the original 16-hex-byte MySQL hashes are based on a terrible custom hash function which has been broken twice, such that 8-character printable ASCII passwords can be broken on a laptop in a few minutes, as documented at MySQL OLD_PASSWORD cryptanalysis? (note updated speed - not as fast/comprehensive as I thought before)

Worse than that is the "Collisions-R-Us" VxWorks vxencrypt password hash algorithm tracked as VU#840249 and publicized last year. It has so few actual possible hash outputs that it can typically be brute-forced in 30 minutes over the network.... And once again it seems that bad advice was given, this time in the CERT response, to just use SHA-512 one time. No mention of either salts or iterations....

Another example is LM hash. Although the underlying hash primitive they used was DES (which doesn't have any practical breaks), the way they used it destroyed the overall strength of the hash.

Note that MD5 has been broken for collision attacks, but not for preimage attacks. So for now we know of no direct attack on MD5-based password hashes and must do brute-force or rainbow. Nevertheless people are now very suspicious of MD5 and it should not be used for password hashing.

Before using brute-force approaches (as covered well by others here), check whether there are direct preimage cryptanalysis attacks on the password hash algorithm used for the hashes you have - whether it has been "broken" for password hashing purposes. If it has been broken, that may be a much faster way to recover good passwords, though brute-force may still be faster for weaker passwords.

For example, the original 16-hex-byte MySQL hashes are based on a terrible custom hash function which has been broken twice, such that 8-character printable ASCII passwords can be broken on a laptop in a few minutes, as documented at MySQL OLD_PASSWORD cryptanalysis? (note updated speed - not as fast/comprehensive as I thought before)

Worse than that is the "Collisions-R-Us" VxWorks vxencrypt password hash algorithm tracked as VU#840249 and publicized last year. It has so few actual possible hash outputs that it can typically be brute-forced in 30 minutes over the network.... And once again it seems that bad advice was given, this time in the CERT response, to just use SHA-512 one time. No mention of either salts or iterations....

Another example is LM hash. Although the underlying hash primitive they used was DES (which doesn't have any practical breaks), the way they used it destroyed the overall strength of the hash.

Note that MD5 has been broken for collision attacks, but not for preimage attacks. So for now we know of no direct attack on MD5-based password hashes and must do brute-force or rainbow. Nevertheless people are now very suspicious of MD5 and it should not be used for password hashing.

Before using brute-force approaches (as covered well by others here), check whether there are direct preimage cryptanalysis attacks on the password hash algorithm used for the hashes you have - whether it has been "broken" for password hashing purposes. If it has been broken, that may be a much faster way to recover good passwords, though brute-force may still be faster for weaker passwords.

For example, the original 16-hex-byte MySQL hashes are based on a terrible custom hash function which has been broken twice, such that 8-character printable ASCII passwords can be broken on a laptop in a few minutes, as documented at MySQL OLD_PASSWORD cryptanalysis? (note updated speed - not as fast/comprehensive as I thought before)

Worse than that is the "Collisions-R-Us" VxWorks vxencrypt password hash algorithm tracked as VU#840249 and publicized last year. It has so few actual possible hash outputs that it can typically be brute-forced in 30 minutes over the network....

Another example is LM hash. Although the underlying hash primitive they used was DES (which doesn't have any practical breaks), the way they used it destroyed the overall strength of the hash.

Note that MD5 has been broken for collision attacks, but not for preimage attacks. So for now we know of no direct attack on MD5-based password hashes and must do brute-force or rainbow. Nevertheless people are now very suspicious of MD5 and it should not be used for password hashing.

Before using brute-force approaches (as covered well by others here), check whether there are direct preimage cryptanalysis attacks on the password hash algorithm used for the hashes you have - whether it has been "broken" for password hashing purposes. If it has been broken, that may be a much faster way to recover good passwords, though brute-force may still be faster for weaker passwords.

For example, the original 16-hex-byte MySQL hashes are based on a terrible custom hash function which has been broken twice, such that 8-character printable ASCII passwords can be broken on a laptop in a few minutes, as documented at MySQL OLD_PASSWORD cryptanalysis? (note updated speed - not as fast/comprehensive as I thought before)

Worse than that is the "Collisions-R-Us" VxWorks vxencrypt password hash algorithm tracked as VU#840249 and publicized last year. It has so few actual possible hash outputs that it can typically be brute-forced in 30 minutes over the network.... And once again it seems that bad advice was given, this time in the CERT response, to just use SHA-512 one time. No mention of either salts or iterations....

Another example is LM hash. Although the underlying hash primitive they used was DES (which doesn't have any practical breaks), the way they used it destroyed the overall strength of the hash.

Note that MD5 has been broken for collision attacks, but not for preimage attacks. So for now we know of no direct attack on MD5-based password hashes and must do brute-force or rainbow. Nevertheless people are now very suspicious of MD5 and it should not be used for password hashing.

Before using brute-force approaches (as covered well by others here), check whether there are direct preimage cryptanalysis attacks on the password hash algorithm used for the hashes you have - whether it has been "broken" for password hashing purposes. If it has been broken, that may be a much faster way to recover good passwords, though brute-force may still be faster for weaker passwords.

For example, the original 16-hex-byte MySQL hashes are based on a terrible custom hash function which has been broken twice, such that 8-character printable ASCII passwords can be broken on a laptop in a few minutes, as documented at MySQL OLD_PASSWORD cryptanalysis? (note updated speed - not as fast/comprehensive as I thought before)

Another example is LM hash. Although the underlying hash primitive they used was DES (which doesn't have any practical breaks), the way they used it destroyed the overall strength of the hash.

Note that MD5 has been broken for collision attacks, but not for preimage attacks. So for now we know of no direct attack on MD5-based password hashes and must do brute-force or rainbow. Nevertheless people are now very suspicious of MD5 and it should not be used for password hashing.

Before using brute-force approaches (as covered well by others here), check whether there are direct preimage cryptanalysis attacks on the password hash algorithm used for the hashes you have - whether it has been "broken" for password hashing purposes. If it has been broken, that may be a much faster way to recover good passwords, though brute-force may still be faster for weaker passwords.

For example, the original 16-hex-byte MySQL hashes are based on a terrible custom hash function which has been broken twice, such that 8-character printable ASCII passwords can be broken on a laptop in a few minutes, as documented at MySQL OLD_PASSWORD cryptanalysis? (note updated speed - not as fast/comprehensive as I thought before)

Worse than that is the "Collisions-R-Us" VxWorks vxencrypt password hash algorithm tracked as VU#840249 and publicized last year. It has so few actual possible hash outputs that it can typically be brute-forced in 30 minutes over the network....

Another example is LM hash. Although the underlying hash primitive they used was DES (which doesn't have any practical breaks), the way they used it destroyed the overall strength of the hash.

Note that MD5 has been broken for collision attacks, but not for preimage attacks. So for now we know of no direct attack on MD5-based password hashes and must do brute-force or rainbow. Nevertheless people are now very suspicious of MD5 and it should not be used for password hashing.