For Operators

Auditing a domain’s passwords usually means uploading your client’s credential hashes to somebody else’s server. Most engagement contracts forbid exactly that. This page is about the mode where you don’t have to.

6,395,497,688 entries per algorithm · md5 · sha-1 · sha-256 · ntlm

The zero-disclosure path

The range endpoint is modelled on the k-anonymity API that lets enterprises put a breached-password check into a password-reset flow without shipping credentials to a third party. You send a prefix; we answer with a bucket.

$ curl https://redhacker.ai/api/range/md5/5f4dcc
3B5AA765D6
3B7F2A11C0
3B0C4E9A72
…  ~380 more

The md5 of password is 5f4dcc3b5aa765d61d8327deb882cf99. Only the bold part came back, and only the first six characters went out. Roughly 380 candidates share that bucket, so knowing you asked about it tells us almost nothing — that is the anonymity set, and it is why a large response is the privacy property working rather than a bug.

Scope: range answers come from the indexed corpus only. Words submitted through the site are searchable via /api/crack as soon as they arrive, but they are not in the index until the next rebuild, so a hash can be found there and absent from a range bucket. That is deliberate: a range response has to be derivable from the write-once index, which is what makes it safe to cache at the edge for a week. If you need the overlay too, use /api/crack or /api/batch — and accept that both disclose the hash you asked about, which is the trade this endpoint exists to avoid.

Everything that needs no plaintext

These come from hash equality, so they work entirely in the zero-disclosure mode — and they are usually the findings that matter most:

• Password reuse clusters. One hash on 400 workstations is one shared local administrator credential and one lateral-movement path to everything.
• Privilege escalation paths. Standard accounts sharing a password with a privileged one.
• LM hashes still stored, and blank passwords.
• Machine accounts excluded from every rate — their passwords are 120 random characters, and counting them measures how many workstations a domain has, not password hygiene.

Bulk lookups

Takes the file you already have — secretsdump output, an NTDS extraction, a hashcat --username list, a potfile — and returns something that composes with the tools you already run. Requires an API key.

POST /api/batch      Authorization: Bearer rh_…

format=json      structured, per-account attribution
format=potfile   <hash>:<plain>, $HEX[] encoded where needed
format=left      what did NOT resolve, one per line

format=left is the reason this endpoint is worth having. A service that hands back a web page ends your workflow; one that hands back a left-list continues it.

Unparseable lines are counted and reported, never skipped. An audit that says “4,000 accounts” when 300 lines failed to parse is a wrong number in somebody’s report.

Coverage

A miss is only actionable if you know the size of the haystack, so it is published:

$ curl https://redhacker.ai/api/coverage
{
  "algorithms": {
    "md5":    { "entries": 6395497688, "expected_bucket_size": 381.2 },
    "ntlm":   { "entries": 6395497688, "expected_bucket_size": 381.2 },
    …
  },
  "range_api": { "prefix_hex_chars": 6, "buckets": 16777216 }
}

Limits

Send a key as Authorization: Bearer rh_… and never in a URL. A key in a query string is written to access logs and CDN cache keys before this service ever sees it — we refuse those and tell you to rotate the key, because by then it is already disclosed.

Where the line is

This service maps a hash to a plaintext that appears in a public corpus. It does not accept an identity — an email address, a username, a phone number — and return a credential for it. That is a different product with a different legal posture, and the design here is deliberately incapable of it: the batch endpoint takes hashes only, and submitters are reduced to an HMAC under a per-install salt so a word can never be traced back to who typed it.