Hashcracky Guide

Each hash has a point value. The algorithm and the difficulty set the value. Slow algorithms multiply the value when the site makes the hash lists.

The leaderboard updates live. Select the name of a player to see the progress of that player in each list. Teams and players appear as separate entries.

Each game has two leaderboard modes. Current shows the live standings. These standings include practice submissions. Game End shows the snapshot from the end of the game. The snapshot decides placements and crowns.

During a game, your algorithm breakdown shows only the algorithms that you cracked. The site shows the full breakdown to all players after the game ends.

The best five players of a game get crowns. The winner gets 2 crowns. Each player in places 2 to 5 gets 1 crown. In a team game, each member of a placed team gets the crowns of the team.

The site gives out crowns after the Idle stage. It uses the Game End snapshot. Crowns stay on your profile. You can see them on the Seasons Dashboard.

The Seasons Dashboard shows the results of players in all games. It shows found hashes, points, games played, the recovery percent of each list, and crown totals.

Open a player to see the game participation and the recovery of each list. Use the page to track your own progress and to compare your results with other players.

Overview

The description of the game, the status, the timer, and the top players.

Lists

Download hash lists. Submit found hashes. Copy ready-made curl commands.

Leaderboard

The rankings of players and teams. Select an entry to see the details.

Boss

The boss health, the rune pool, the milestones, and your damage per hash.

Bounty

The bounty hashes of each list.

Items

Your reroll credits and your item.

Announcements

A live feed of player activity. The feed joins the new found hashes and bounties of one player in one list.

Teams

Make, join, and manage teams.

Scores

A chart of the found hashes of each player over time.

Unfounds Report

A summary of the hashes that no player recovered. It opens after the game ends.

The Event Ticker at the bottom of the page shows game events. One example is a change of leader.

Send one line for each found hash. Add the salt when the hash has a salt.

The site tries more than one salt order. Both salted formats work when the salt is correct. The site decodes values in the $HEX[...] form before it checks them. Hashcat output often has this form.

1. Open the Lists tab of an Active or Past game.
2. Select Choose file and pick your file.
3. Select Submit found hashes next to the hash list.
4. Read the summary. It shows the accepted lines and the rejected lines.

Each list on the Lists tab has a Copy curl (submit) button. The command has the game ID, the list ID, your token, and the required header.

curl -X POST \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "X-Requested-With: XMLHttpRequest" \
  -H "Content-Type: text/plain" \
  --data-binary @founds.txt \
  "https://hashcracky.com/api/game/GAME_ID/LIST_ID/submit"

The API accepts three content types:

One submission can have up to 500,000 lines. Split a larger set into more than one submission.

The API limits the request rate. When you send too many requests, the site returns HTTP 429. Wait for the time in the Retry-After header. Then try again.

1. The site removes duplicate lines inside your submission.
2. The site decodes the $HEX[...] values.
3. The site checks each line against the hash list. The hash and the plaintext must match.
4. The site rejects a line that you already found.
5. The site records each new hash as your found hash. Your points update at once.
6. Each accepted hash does damage to the boss.

After each submission, the site returns a summary. The summary shows how many lines the site accepted and rejected. It gives a reason for each rejected line. The API returns the summary as JSON.

• The hash and the plaintext do not match a hash in the list.
• You already submitted the line before.
• The line is a duplicate in the same submission.
• The site cannot decode a $HEX[...] value.

Check your format. Check that you send the lines to the correct list. The summary shows the reason for each rejected line.

The site accepts submissions in the Active stage and in the Past stage. The site blocks all submissions in the Idle stage, which lasts 8 hours after the game ends. This rule keeps the final standings fair.

Submissions in the Past stage count toward your personal stats and the Seasons Dashboard. They do not change placements or crowns.

The Lists tab has these download buttons for each list:

• Download remaining hashes removes the hashes that you or your team already found. This is the default.
• Download my found hashes gives all your found hashes.
• Download my unique hashes gives your found hashes that no other player or team recovered.

The API gives the same downloads. Add ?dynamic=false to the first URL to get the full original list.

curl -H "Authorization: Bearer YOUR_TOKEN" \
  "https://hashcracky.com/api/game/GAME_ID/LIST_ID/left"

curl -H "Authorization: Bearer YOUR_TOKEN" \
  "https://hashcracky.com/api/game/GAME_ID/LIST_ID/found"

curl -H "Authorization: Bearer YOUR_TOKEN" \
  "https://hashcracky.com/api/game/GAME_ID/LIST_ID/found/unique"

The site keeps a log of your latest submissions. You can see it in the profile section of your account page. The log shows the accepted and rejected totals and the result of each submission. Use it to find problems in your tools.

Open the Teams tab of a game. A team can have up to 8 members, with the captain. You can make a team before the game starts. Use that time to find members and plan.

Each player can be on one team in each game. To join another team, leave your team first.

Request

This is the default join policy. Players ask to join. The captain approves or denies each request.

Invite-only

Only invited players can join. The captain sends the invites.

• Each member submits hashes as a solo player does.
• The team found set is the union of the found hashes of all members. A hash that two members find counts one time.
• The site recalculates the team score when a member submits, joins, or leaves.
• During a game, your personal stats count only the hashes under your own account. The hashes of your teammates count for the team only.
• After the game ends, a member who leaves gets credit for the full team found set. Teamwork does not reduce your personal total.
• The leaderboard shows teams and players as separate entries.

• Invite players: Send an invite to a player.
• Answer join requests: Approve or deny a player who asks to join. This applies to the Request join policy.
• Submit for a teammate: Read Credit submissions.

When the captain leaves, the site gives the captain role to another member.

Any member can leave at any time. The site recalculates the team score from the members that remain. The unique hashes of the member who leaves also leave the team total. Plan your team with care.

If you leave while the game is in progress, you keep only the hashes under your own account. This rule stops team changes in the middle of a game.

If you leave after the game ends, you get credit for the full team found set. You can join or make another team in the same game after you leave.

Each game has one boss with a random name. All players work together to bring the health of the boss to zero. Open the Boss tab to see the name, the health bar, the milestones, and your damage per hash.

The boss health is the number of hashes in all lists times 32. The minimum health is 1,875. A game with 5,000 hashes has a boss with 160,000 health.

Each accepted hash does damage to the boss. The type of the hash sets the damage:

• A game-unique hash does the full damage per submission. It starts at 3 and rises with each milestone.
• A player-unique hash does 2 damage, plus the bonus of your item.
• The bounty boost multiplies the total damage of all hashes.

The Boss tab shows the formula for your next submission:

(game-unique hashes × damage per submission
 + player-unique hashes × (2 + item bonus))
 × (1 + bounty boost)

A team never reduces your damage. A hash that you are first to find in the game does the full damage. This is true when you play alone and when you play on a team.

A game has more than 25 milestones. The milestones have four types: total submissions, unique hashes recovered, different players who submitted, and active teams.

Each milestone that the community reaches adds damage per submission for the rest of the game. The bonuses stack. Milestones are the main way to raise the damage. Even a player with a few hashes helps to reach the player milestones.

The rune pool is on the Boss tab. It rolls new runes every 30 minutes. When the runes align, the boss takes damage. A better alignment does more damage.

Each player who submits valid hashes in the cycle joins the pool. Each of these players adds to the damage. The server decides the roll, so all players see the same result.

When the boss dies, the site opens a hidden bonus list in the Lists tab. The list has 25,000 MD4 hashes. The site makes them from the plaintexts of the other lists.

The bonus hashes give extra points. They can also show patterns in the other lists. If the boss is alive when the game ends, the players lose the bonus list.

The Bounty tab shows special hashes from every list. The site picks up to 888 bounties for each list. The pick has a balance of low-value, medium-value, and high-value hashes.

The site hides the bounties until the game is Active. When a player recovers a bounty, the tab shows the plaintext and the name of the player.

The boost applies to every submission of every player. It does not matter who recovered the bounty.

1. Find hashes. You earn one reroll credit for each 10,000 hashes that you find.
2. Open the Items tab. Spend one credit to roll 8 candidate items.
3. Pick one candidate and equip it. The site discards the other candidates.

The roll uses the credit, not the equip step. If you do not like the candidates, spend another credit for a new set. Items belong to one game. They do not carry over to other games.

The bonus adds to the damage of each player-unique hash that you find. It does not apply to game-unique hashes.

Items also have an element, a class, and a name. These only change the look. Only the rarity changes the damage.

You need only a username and a password. The site does not ask for an email address or a real name. After you register, you can open games, download hash lists, and submit hashes.

When you register, the site gives you a set of single-use recovery codes. The site shows them one time. Each code works one time. A recovery code is the only way to reset a forgotten password.

You can see how many codes remain on the Account Settings page. You can also make a new set there. A new set makes all earlier codes invalid.

You can add a passkey or a hardware security key on the Account Settings page. After you add one, a password sign-in asks for it as a second step. A passkey can also sign you in without a password.

You must enter your current password to remove a key or to make new recovery codes.

Open the Account Settings page and select Copy Token. Put the token in the Authorization header after the word Bearer. Keep your token private.

Hashcracky collects only a small amount of data. The site does not ask for or keep email addresses, real names, or other personal information. Account data is only a username, an encrypted password, and your game activity. Game activity includes submissions, scores, and achievements.

The site uses IP addresses and user-agent strings for a short time in memory to limit the request rate and to stop abuse. It does not keep them in normal operation.

For all details, read the Privacy Policy.

All players must keep a positive and respectful environment.

• Do not cheat. Do not act in an unfair way.
• Do not try to disrupt the event or the experience of other players.
• Do not use offensive language in public names or in messages to players and organizers.
• Do not ask for or accept help from other people while a game is active.

A violation can cause a warning, a temporary suspension, or a permanent ban.

No. Many players use one GPU. Players with only a CPU can also do well. Good attack methods, rules, masks, and analysis of found plaintexts matter as much as speed.

Yes. The site has no limits on tools, hardware, cloud services, or distributed systems. You can use Hashcat, John the Ripper, your own tools, or cloud GPUs.

Yes. When the Idle stage ends, submissions work again. They count toward your stats. They do not change the placements. Read When you can submit.

Read Why the site rejects a line.

Put the salt in your line. Read Submission format for the two accepted formats.

You must be the captain. Add ?credit=USERNAME to the submit URL. Read Credit submissions.

The result depends on the game stage. Read Leave a team.

Read How damage works.

The site opens a bonus hash list. Read The bonus hash list.

The project started as Jabbercracky. It began with a workshop that I made. The workshop had a skills test list. I enjoyed CTFs and I used CMIYC lists to learn.

Hashpwn and HashMob helped the early community work. Many users gave suggestions and feedback. Among them are Tycho, Flagg, JP, Phurtim, Stealthsploit, A1131, Partly, Fordy, Kpd, Chick3nman, Afsa, Cake, Vivaldi, Blandy, and Cyclone.

After DEFCON33, we changed the project to a more collaborative experience and renamed it Hashcracky. We stand on the shoulders of giants. Hashcracky needs the community to exist. In memory of Flagg.

Send an email to contact@hashcracky.com. We work with you to find your goals, pick a theme and a difficulty, and set a date.

The site has no limits on tools. Two tools cover most of the needs on Hashcracky.

• Hashcat: A fast tool that uses the GPU to recover passwords. The Algorithm Reference lists the Hashcat mode of each algorithm.
• MDXfind: A tool for the CPU and the GPU. It is good at nested and composite hashes, which appear often on the site.

A nested algorithm applies more than one hash function in sequence. The site applies the innermost function first and sends its output to the next function. Some nested algorithms add a salt at different places in the chain. Slow algorithms, for example bcrypt, are also in this group.