Cryptanalysis & Password SecurityInteractive Attack Simulator

Rainbow Table Attack Visualizer

A rainbow table is a massive precomputed lookup table of password hashes that trades offline storage space for instant online attack execution. Stolen password hashes can be cracked in milliseconds via O(1) lookups. Explore how hash lookup tables operate — and why adding a random salt renders rainbow tables completely ineffective.

Rainbow Table Attack Workspace

Simulate precomputed lookups, inspect hash chains & salting defenses

Quick Test Passwords:
Lookup Execution

0.020 ms

Instant O(1) Index Match

Indexed Table Size

20 entries

Precomputed Hashes

Attack Status

CRACKED

Hash Found in Table

Time Complexity

O(1) Time

O(N) Offline Storage

⚠️ Password Hash Successfully Cracked!SHA1

Target password "password" matched hash 4889ba9b instantly without brute-force computation!

Interactive Hash Lookup Pipeline Step Visualizer

Step 1

Input Password

"password"

Step 2

Compute Hash H(p)

4889ba9b

Step 3

Table Map Query

O(1) Map.get(Hash)

Step 4

Result

Match: "password"

Understanding Rainbow Table Mechanics & Defense

How Rainbow Tables Work

Rainbow tables are precomputed mappings between hashes and plaintext passwords. Attackers compute hashes for millions of password variations offline. Instead of storing every pair raw (which takes terabytes), rainbow tables use reduction functions to condense chains of hashes:

// Hash Chain Reduction Sequence:

P₀ → H(P₀) → R₁(H₀) → P₁ → H(P₁) → R₂(H₁) → P₂ ... → H(Pₖ)

// Only starting plaintext P₀ & final hash Hₖ are stored in the table!

O(1) Attack Execution Flow:

  1. Attacker obtains a database of unsalted password hashes
  2. Attacker passes the target hash through table lookup index
  3. If matched in table, chain is recomputed from starting password to reveal plaintext
  4. Password is cracked instantly without brute-forcing every candidate on the fly

Why Salting Defeats Rainbow Tables

A cryptographic salt is random data generated per password and prepended before hashing. Even if two users pick identical passwords (e.g. "password"), their unique salts force completely different hash outputs.

Unsalted (Vulnerable)

Password: password

Hash: 5baa61e4...

⚠️ Exists in precomputed tables. Instantly cracked!

Salted (Protected)

Salt: e9a1b87f

Hash: 9f23b4d7...

✓ Unique hash. Precomputed table lookup fails!

With a 128-bit salt, an attacker would need 2128 (approx 3.4 × 1038) separate rainbow tables — requiring more physical storage than exists in the observable universe.

Production Standards & Best Practices

Insecure Practices to Avoid

  • Using un-salted single fast hashes (MD5, SHA-1, SHA-256) for password storage
  • Reusing a single global salt ("static salt" or "pepper only") across all users
  • Short or low-entropy salts (less than 128 bits)
  • User-controlled or predictable salt values

Modern Security Recommendations

  • Argon2id: Memory-hard Password Hashing Competition winner
  • bcrypt: Time-tested key stretching algorithm with built-in salting
  • scrypt: Memory-hard primitive designed to hinder hardware ASICs
  • Unique cryptographic random salt (minimum 16 bytes / 128 bits) per user account

Key Standards & Documentation:

OWASP Password Cheat SheetNIST SP 800-63 StandardsWikipedia: Rainbow TableCloudflare Hashing Guide