This is a cryptographic challenge I was given:

I have a list of 1000 hashed email addresses where I know the domain name for them (eg. "@gmail.com").

According to hashes.com:

Possible algorithms:

  • SHA1, SHA1(UTF16-LE($plaintext)),
  • MySQL4.1/MySQL5, mysql5(mysql5($plaintext).:.$plaintext),
  • sha1(sha1($plaintext)),
  • sha1(sha1(sha1($plaintext))),
  • sha1(md5($plaintext)),
  • sha1(md5(md5($plaintext))),
  • sha1(strtoupper(md4(unicode($plaintext)))),
  • sha1(sha1($plaintext).:.$plaintext)

How can I guess the whole email address? Which tool should I use to decrypt them?

(I've trie following the https://medium.com/@matthew.bajorek/using-hashcat-to-recover-hashed-emails-8ba306aab18a tutorial but so far was unsuccesful.)

  • To clarify - so you only only the hash of the actual username besides the domain and password?.. What you're trying to do is also probably illegal. Commented Jan 28, 2022 at 18:16
  • Do you know the hashing algorithm? Which one is it? Commented Jan 28, 2022 at 18:19
  • It is unclear for me what you are trying to do. If you have the hash of the email - what has the username to do with this? And what salt you are talking about, what is the exact algorithm? Also title asks for the salt while question body asks for the full mail - which are likely different things. Please also note that questions about breaking security for your own gain are off-topic here, but I don't understand enough of your question yet to determine if this is the case here. Commented Jan 28, 2022 at 18:22
  • Updated the post. @TilmanSchmidt
    – rookie133t
    Commented Jan 28, 2022 at 18:37
  • 1
    "I've tried following the medium.com/@matthew.bajorek/… tutorial but so far was unsuccesful" - looks like a useful tool for the job and a well written explanation. Which means you likely failed either because you did not follow the instructions properly, the given pattern did not match the emails you should find or the given algorithm did not match the algorithm actually used. Commented Jan 28, 2022 at 21:44

1 Answer 1


Your best bet is a brute force attack on the local part, ie. the part before the @ sign. That is, you generate a possible local part, append the known domain part, hash it with all the possible algorithms and look up the results in your list. Repeat until you have found the requested number of hits.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .