Dehash
Test whether an MD5, SHA-1, or SHA-256 hash can be matched to a common plaintext, and learn why hashes cannot be truly decrypted. Everything runs client-side; your hash never leaves your browser.
Warning: This hash was found in a common password database. If this is a password hash, the password is extremely weak and should be changed immediately.
This hash was not matched by the 408 bundled candidates. That result does not prove the input is strong, unique, or unrecoverable elsewhere.
Paste a hash below to check it against known values
Check a Hash Against Known Values
Checks exactly 408 bundled candidate strings. All processing happens in your browser.
What “Dehashing” Means Here
“Dehashing” is an informal search term, not a cryptographic inverse. Cryptographic hash functions like MD5, SHA-1, and SHA-256 are one-way functions. This page hashes each of 408 bundled candidate strings and reports a candidate only when its digest equals the value you entered. It does not decrypt or reverse an arbitrary hash.
This page focuses on what "dehashing" can and cannot recover. For a shorter auditing workflow, use the hash lookup tool. If a password hash can be matched using a common dictionary, that password should be changed.
How Dehashing Works
1. Paste Hash
Enter any MD5 (32 chars), SHA-1 (40 chars), or SHA-256 (64 chars) hash value.
2. Local Computation
Your browser computes hashes for all dictionary entries and compares them locally.
3. Instant Result
If a digest matches, the corresponding bundled candidate is shown. A digest can have more than one possible input, so this is not proof of a unique original value.
Dehashing vs Decryption
Many people confuse dehashing with decryption, but they are fundamentally different processes:
| Property | Dehashing | Decryption |
|---|---|---|
| Method | Dictionary/rainbow table lookup | Mathematical reversal with key |
| Requires key? | No | Yes |
| Guaranteed? | No — only works for known inputs | Yes — always recovers original data |
| Works on | MD5, SHA-1, SHA-256 (unsalted) | AES, RSA, ChaCha20 |
Which Hashes Can This List Check?
| Algorithm | Length | Lookup coverage | Why |
|---|---|---|---|
| MD5 | 32 hex chars | Yes (common inputs) | Fast to compute, massive rainbow tables exist |
| SHA-1 | 40 hex chars | Yes (common inputs) | Fast to compute, widely targeted |
| SHA-256 | 64 hex chars | Sometimes | Slower to compute but still vulnerable for weak inputs |
| bcrypt | 60 chars | No | Unique salt per hash, intentionally slow |
| Argon2 | Variable | No | Memory-hard, salted, designed to resist lookup attacks |
Frequently Asked Questions
What is dehashing?
“Dehashing” is an informal name for known-value lookup. This tool hashes each of its 408 bundled candidate strings and reports a candidate only when its digest equals the value you entered. It does not reverse the hash function.
Can you dehash MD5?
This tool can find an MD5 match only when the input is one of its 408 bundled candidate strings. A match identifies a known candidate, not a general method for recovering arbitrary inputs.
Is dehashing the same as decryption?
No. Decryption reverses encryption using a key to recover the original data. Dehashing is not true reversal — it is a lookup process that checks if a hash matches a known input. Hash functions are mathematically irreversible, unlike encryption.
Which hash algorithms can be looked up?
This tool compares MD5 (32 hex characters), SHA-1 (40), and SHA-256 (64) digests against the same 408 known candidate strings. It does not support salted password-hash formats such as bcrypt or Argon2.
Is my data safe when using this lookup?
The lookup runs in your browser. MD5 is computed by bundled JavaScript; SHA-1 and SHA-256 use the browser Web Crypto API. The hash you paste is not sent to this site's server.
Why can't the tool find my hash?
No match means only that none of the 408 bundled candidate strings produced the digest. It does not prove that the input is strong, unique, or unrecoverable by some other method.