Hash Lookup
Check whether an MD5, SHA-1, or SHA-256 hash matches a known common password or string. This lookup runs client-side and is meant for auditing known values, not guaranteed recovery.
Warning: This hash was found in a common password database. If this is a password hash, the password is extremely weak and should be changed immediately.
This hash was not found in our database of common passwords. This could mean the original value is a strong, unique string.
Paste a hash below to look it up
Lookup Hash
Checks exactly 408 bundled candidate strings. All processing happens in your browser.
How Hash Lookup Works
Hash functions are one-way - you can't mathematically reverse them to get the original input. A hash lookup checks your hash against a local table of known values, which is useful for spotting common passwords, copied sample hashes, and weak test data.
This tool loads exactly 408 bundled candidate strings, computes their MD5, SHA-1, and SHA-256 hashes entirely in your browser (Web Crypto for SHA-1/SHA-256 and bundled JavaScript for MD5), and checks if your digest matches any of them. For broader background on recovery terminology, see the dehash explanation.
Paste Hash
Enter any MD5 (32 chars), SHA-1 (40 chars), or SHA-256 (64 chars) hash.
Local Computation
Your browser computes hashes for all entries in the database and compares.
Instant Result
If a match is found, the matching bundled candidate is shown. This does not prove a unique original input.
Why Hash Lookup Matters
Hash lookup tools help security professionals and developers audit password strength. If a digest matches a candidate from a small common-value list, that candidate is unsuitable as a password.
- Penetration testing: Check if leaked hashes correspond to weak passwords
- Security auditing: Verify that your users aren't using common passwords
- Education: Demonstrate why MD5 and SHA-1 are unsuitable for password storage
- Incident response: Quickly identify compromised accounts with weak passwords
Hash Algorithm Comparison
| Algorithm | Output Length | For Passwords? | Lookup Difficulty |
|---|---|---|---|
| MD5 | 32 hex chars | Never | Very Easy |
| SHA-1 | 40 hex chars | Never | Very Easy |
| SHA-256 | 64 hex chars | Not ideal | Easy (for common inputs) |
| bcrypt | 60 chars | Recommended | Very Hard |
| Argon2 | Variable | Best | Extremely Hard |
Frequently Asked Questions
What is a hash lookup?
A hash lookup checks a digest against hashes computed from known candidates. If this tool finds a match, it shows the matching bundled candidate. It does not decrypt the digest, recover arbitrary inputs, or prove that the candidate was the unique original input.
Is my hash sent to any server?
No. Everything runs 100% in your browser. The common password list is loaded into memory, hashed locally using the Web Crypto API, and compared entirely client-side. Your hash never leaves your device.
Why can't it find my hash?
The tool checks exactly 408 bundled candidate strings. No match means only that none of those candidates produced the digest; it does not establish password strength or rule out other recovery methods.
Can this crack bcrypt or Argon2 hashes?
No. Bcrypt and Argon2 use unique salts for each hash, making pre-computed lookup tables useless. This is exactly why they're recommended for password storage. Only fast, unsalted hashes like MD5, SHA-1, and SHA-256 are vulnerable to lookup attacks.