🔐 Hash Auditor

Audit your passwords. Hash them. Identify hashes. Crack your own.

"The password is the lock. Most people use a paper clip."

What is it?

A pocket knife for password hygiene: measure how weak your passwords really are, compute hashes in common formats, identify a hash's algorithm from its length, and brute-force your own hashes with a wordlist and common mutations. Every cracked hash in your lab is a story your novel's hacker would tell with a smirk.

Features

Core

• 📏 check — length, character classes, entropy, weak-list, patterns, verdict
• 🔑 hash — md5, sha1, sha256, sha512
• 🕵️ identify — guess the algorithm from hash length
• 💥 crack — wordlist attack with mutations (Cap1tals, +123, +!, ...)

v0.2.0 — the cracking-lab expansion

• 🧬 audit — integrated risk audit: strength + breach exposure + leet + date + keyboard-walk + randomness, folded into one 0-100 risk score
• 🎯 recognize — ranked hash-format identification with confidence scores (bcrypt, argon2, scrypt, PBKDF2, Django, phpass, LDAP, MySQL, ...)
• 🌈 rainbow — build, save and query real rainbow tables (reduction chains)
• 🎭 mask — hashcat-style mask attacks (?l?d?s, custom charsets) with keyspace/entropy/time estimates
• 🔀 combine — combinator and hybrid word+mask attacks
• 🧩 pcfg — probabilistic context-free grammar guesses in probability order
• 📚 breach — simulated breach-corpus exposure scoring (Zipf-ranked)
• 📜 policy — configurable password policies with presets (basic/corporate/NIST)
• 🔄 history — password-rotation enforcement (reuse, similarity, mutation gates)
• 🎲 generate — diceware, syllable, leet and PIN generators with entropy
• 📊 stats — wordlist statistics incl. Zipf-exponent fit and Markov bigrams
• 🔗 similarity — edit distance, mutation classification, clustering
• ⌨️ keyboard — QWERTY walk generation and detection
• 📅 dates — date-fragment extraction and date-password detection
• 🔤 fingerprint — structural shape fingerprints (Password123! → ULDS)
• 🧮 entropy — Shannon, chi-squared, Markov and effective-bit analysis
• 🗂️ parse — hash-dump parsing (user:hash, CSV, salted) → hashcat format
• ➕ pure-Python checksums (CRC32/CRC16/Adler-32/FNV/Luhn), incremental brute with checkpoint/resume, leet-reversal dictionary matching, and wordlist pipeline tools
• 📦 Zero dependencies

Install

pip install hash-auditor

From source:

git clone https://github.com/AnonymoDGH/hash-auditor
cd hash-auditor
pip install -e .

Quickstart

# 1. Audit a password
hashaudit check "password123"
# [*] length:           11
# [*] character classes:2
# [*] entropy (approx): 51.5 bits
# [-] in the known-weak list
# [-] verdict: weak

# 2. Hash something
hashaudit hash --algo md5 "sunshine"
# 3e1d2e2e1e7c7a1c5e2d8f6f1c2e3d4a  (fake value — compute your own)

# 3. Identify a hash by its length
hashaudit identify 5d41402abc4b2a76b9719d911017c592
# md5

# 4. Crack your own hash with a wordlist
hashaudit crack --hash 5d41402abc4b2a76b9719d911017c592 --wordlist rockyou.txt
# [+] FOUND: 'hello'

# 5. v0.2.0: integrated risk audit
hashaudit audit "Summer2024!"
# [*] risk score: 87/100 -> critical
# [-] issues:
#     - found in breach corpus ...

# 6. v0.2.0: identify a hash format with confidence
hashaudit recognize '$2b$12$...'
# 1. bcrypt (confidence: 0.97) -- bcrypt revision 'b'; cost factor 12

# 7. v0.2.0: mask attack on your own hash
hashaudit mask '?d?d?d?d' --hash <md5-of-a-pin>
# [+] FOUND: '1234' after 1,235 attempts

CLI reference

How it works

Tests

pip install pytest
pytest

License

MIT — audit your own habits, crack your own hashes, and keep the villain's password cracking on the page.