hashcrackdb

API documentation — v1

Overview

hashcrackdb exposes a small JSON API for looking up precomputed hash → plaintext pairs. All responses are application/json. All hashes must be hex (lowercase or uppercase), except mysql41 which uses the *HEX40 form.

Base URL: https://hashcrackdb.com
Auth: none — public, read-only service.
Rate limit:

Endpoints

GET /api/info

Returns the list of algorithm databases currently loaded on the server.

Response

{
  "loaded_algorithms": ["md5", "sha1", "sha256", "ntlm"],
  "total_loaded": 4
}

GET /api/lookup/auto/{hash}

Auto-detects candidate algorithms based on hash length and returns all matches. Useful when you don't know which algorithm produced the hash.

Path parameters

Name	Type	Description
`hash`	string	1–128 hex chars, or `*` + 40 hex chars (mysql41).

Response

{
  "hash": "5f4dcc3b5aa765d61d8327deb882cf99",
  "found": true,
  "matches": [
    { "algorithm": "md5", "plaintext": "password" }
  ]
}

Length collisions: md5, ntlm, and md5md5 all produce 32-char hex hashes. The matches array may contain multiple entries if a hash collides across algorithms.

GET /api/lookup/{algorithm}/{hash}

Forces a lookup against a specific algorithm database. The hash length must match the algorithm's expected length.

Path parameters

Name	Type	Description
`algorithm`	string	One of the supported algorithms. See Algorithms.
`hash`	string	Hash to look up; length must match the algorithm.

Response (hit)

{
  "hash": "5f4dcc3b5aa765d61d8327deb882cf99",
  "algorithm": "md5",
  "found": true,
  "plaintext": "password"
}

Response (miss)

{
  "hash": "0000000000000000000000000000abcd",
  "algorithm": "md5",
  "found": false,
  "plaintext": null
}

POST /api/lookup/bulk

Look up multiple hashes in a single request. Each hash is tried against every algorithm matching its length, and all matches are returned.

Request body

{
  "hashes": [
    "5f4dcc3b5aa765d61d8327deb882cf99",
    "e10adc3949ba59abbe56e057f20f883e",
    "098f6bcd4621d373cade4e832627b4f6"
  ]
}

Constraints

`hashes`	array, 1–100 items
each item	1–128 chars, hex or mysql41 form

Response

{
  "results": [
    {
      "hash": "5f4dcc3b5aa765d61d8327deb882cf99",
      "found": true,
      "matches": [
        { "algorithm": "md5", "plaintext": "password" }
      ]
    },
    {
      "hash": "e10adc3949ba59abbe56e057f20f883e",
      "found": true,
      "matches": [
        { "algorithm": "md5", "plaintext": "123456" }
      ]
    },
    {
      "hash": "0000000000000000000000000000abcd",
      "found": false,
      "matches": []
    }
  ]
}

429 Too Many Requests: returned when the rate limit is exceeded. Back off and retry later.

Examples

curl — single auto lookup

# Look up an MD5 hash without specifying the algorithm
curl https://hashcrackdb.com/api/lookup/auto/5f4dcc3b5aa765d61d8327deb882cf99

curl — explicit algorithm

curl https://hashcrackdb.com/api/lookup/sha1/5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8

curl — bulk lookup

curl -X POST https://hashcrackdb.com/api/lookup/bulk \
  -H "Content-Type: application/json" \
  -d '{"hashes":["5f4dcc3b5aa765d61d8327deb882cf99","098f6bcd4621d373cade4e832627b4f6"]}'

Python

import requests

# Bulk lookup
r = requests.post(
    "https://hashcrackdb.com/api/lookup/bulk",
    json={"hashes": [
        "5f4dcc3b5aa765d61d8327deb882cf99",
        "e10adc3949ba59abbe56e057f20f883e",
    ]},
    timeout=10,
)
r.raise_for_status()
for result in r.json()["results"]:
    if result["found"]:
        for m in result["matches"]:
            print(f"{result['hash']} ({m['algorithm']}) -> {m['plaintext']}")
    else:
        print(f"{result['hash']}: not found")

Bash — crack a file of hashes

# hashes.txt: one hash per line
jq -Rn '{hashes: [inputs | select(length > 0)]}' hashes.txt \
  | curl -s -X POST https://hashcrackdb.com/api/lookup/bulk \
      -H "Content-Type: application/json" \
      --data-binary @- \
  | jq -r '.results[] | select(.found) | "\(.hash):\(.matches[0].plaintext)"'

Supported algorithms

Algorithm	Length	Format
`md5`	32	hex
`md4`	32	hex
`md5md5`	32	hex (md5 of md5)
`md5half`	16	hex (first half of md5)
`ntlm`	32	hex
`sha1`	40	hex
`sha224`	56	hex
`sha256`	64	hex
`sha384`	96	hex
`sha512`	128	hex
`ripemd160`	40	hex
`whirlpool`	128	hex
`mysql41`	41	`*` + 40 hex (uppercase)

Call GET /api/info to see which of these are currently loaded on the server.

Errors

Status	Meaning
`400`	Invalid hash format or unsupported algorithm.
`422`	Request body failed validation (too many hashes, wrong shape, etc.).
`429`	Rate limit exceeded at the edge.
`500`	Internal server error. No details leaked; check back later.