HSH.lol

Enter your hashes below:

Supported Hash Algorithms

Our hash testing service utilizes Hashcat, chosen for its exceptional speed and efficiency. As a result, it supports all hash types compatible with Hashcat. If you do not specify a hash type, the service will attempt to automatically detect it.

However, since we do not know how your hash was generated, automatic detection may lead to errors.

Available Wordlists

Name	Description	~Passwords (M)
weakpass_4.txt	Huge mixed list from public breaches	2,200
Hashes.org	Community-contributed cracked hashes	1,400
hashkiller24.txt	Hashkiller dump, common password matches	280
cyclone_hk.txt	HashKiller subset, cleaned and sorted	250
hashmob.net.user.found.txt	Verified found passwords from HashMob	68
hk_hlm_founds.txt	HashKiller high-quality found hashes	37
kaonashi14M.txt	High-quality passwords collected from leaks	12
ignis-10M.txt	Curated popular 10M passwords	9
piotrcki-wordlist-top10m.txt	Common password list by popularity	8

Total coverage: Over 4.2 billion unique passwords checked using more than 40 GB of curated wordlists.

Cracking Server Info

Component	Details
GPU	4× RTX 3060, 12 GB VRAM, 24.1 TFLOPS
CPU	Intel Xeon E5-2673 v4, 16 cores
RAM	52 GB
Storage	490.6 GB NVMe, 1773 MB/s
Network	54 Mbps upload / 647 Mbps download
CUDA Compute	Max 12.8
Performance	24.7 DLPerf

About HSH.lol

HSH.lol is online tool to check how strong your hash really is. It's built for security folks, pentesters, and sysadmins.

We don't brute-force hashes. Instead, we match them against huge public wordlists and leaks.

How it works:

• You paste a hash — MD5, NTLM, SHA256, etc.
• We detect the hash type automatically.
• Then we search it against billions of known passwords (RockYou, Hob0Rules, leaks, and more).
• If we find a match — we show the original password.
• If not — we tell you it wasn't found. That means it’s less risky, but not bulletproof.

Who it's for:

• Pentesters — quick hash check without firing up heavy tools.
• Developers — make sure user passwords aren't too weak.
• Sysadmins — audit password dumps or DB exports.
• Security teams — use it in audit workflows or reports.

Goal: Show how easily your password can break. Not to break it — to warn you.