I'm trying to understand how easy it is to crack a SHA1 hashed password. I have a training database giving hundreds of password hashed.

I have tried to use some online tools to crack them and I have realized that I can only crack relatively simple passwords with them.

For what I know, to crack a hask, you generally use rainbow tables. In that sense, for me, you can only crack simple passwords. But some people online seem to say that tools like John the Ripper or Hashcat can crack anything.

So I was wondering, is it always possible to crack a SHA1 password (even a really complex one) ?

Thank you in advance for your help

  • Tools like John the Ripper or Hashcat can crack almost anything. Using just a cryptographic hash is not sufficient for security, an iterated password hash is needed such as PBKDF2, PHPO password_hash, bcrypt, Argon2i needs to be used, these all require substantial CPU time and in sone cases substantial memory. – zaph Jul 14 '18 at 13:57

No, it is not possible to crack just any SHA-1 hash. Currently, there are two main issues with using the hash function for security purposes (not specifically password hashing):

  1. It is a very fast hash, meaning a brute force attack will run much more quickly than it would if you were to correctly use a slow KDF. The fact that SHA-1 is fast does not allow you to crack any password, but it does mean you can attempt more guesses per second.

  2. It is vulnerable to collision attacks, as Google showed. A collision attack allows someone to create two inputs with the same hash. However, it does not allow them to reverse a hash or to modify an input without affecting the resulting hash. That would be a different kind of attack called a preimage attack, and SHA-1 is not vulnerable to that attack.

So no, you are not able to crack just any password that has been hashed with SHA-1 unless the password is short or weak. That does not mean you should use it for password hashing however, since it is so fast and is efficiently implemented on a GPU.

  • 2
    Thank for your answer ! It is very clear. So to conclude, when a company's database gets dumped by hackers, if the passwords where hashed and salted, all the complex password cannot be cracked by the hackers, right ? They can only access the weak and short ones ? – KB303 Jul 14 '18 at 4:17
  • 2
    @KB303 Correct. However, many, many people do not use long and complex passwords! – forest Jul 14 '18 at 4:48
  • how is #2 germane to this discussion? – dandavis Jul 16 '18 at 18:19
  • @dandavis #2 is a security issue with SHA-1 but, as I point out, not one which impacts password cracking. I included it for completeness sake. – forest Jul 16 '18 at 22:41
  • @forest Now the important question is: what do you consider a "long and complex password"? – MichalH Jul 5 '20 at 18:34

SHA1 is perhaps the worst scenario for securing passwords - except for plaintext storage or schemes without salt. Password cracking tools not only test lists of passwords, but also replace individual letters, such as S with $, double letters, sample combinations of uppercase and lowercase letters for all passwords in the list, combine words, etc.

In reality, the vast majority of passwords can be broken, even most of the complex passwords.

Above all, the difference is how long it takes to crack with specific hardware, whether it takes several months or a few seconds. With good password hashing schemes like Argon2 or Scrypt, cracking takes the longest, with SHA1 or MD5 the shortest.


So I was wondering, is it always possible to crack a SHA1 password (even a really complex one) ?

Yes. It's just a matter of time and effort. The interesting question is "is it possible to crack any SHA1 password within " to which the answer is currently: No.

The reality is that you can crack any hash. It just takes quite a long time in the worst-case scenario.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.