Solutions / Enterprises

Enterprise Password Audit and Access Recovery

Measure how many of your employees' passwords an attacker could actually recover, fix what matters, and prove the improvement with numbers. When a company file is locked by a forgotten password, recover access without rebuilding from scratch.

For IT, security and compliance teams, on data the organization owns.

See the Active Directory audit Talk to us

In short

Evidence, not assumptions: recovery rate, weak patterns and password reuse measured on your own hashes.
Proof of remediation: a baseline run and a second run after your fixes, compared in the report.
Compliance mapping: findings mapped to ISO 27001, NIS2 and DORA controls.
Privacy by design: plaintext passwords never appear in reports, and files are deleted on a fixed schedule.

Business cases

Password policy audit

Test whether your current policy really prevents guessable passwords such as Company2026! or Summer2025, before an attacker does.

Compliance evidence

Give auditors measurable results on authentication controls, with a before-and-after comparison that shows the effect of remediation.

Locked company files

Spreadsheets, documents or archives protected by an employee who has left, or a password lost during a migration.

How the Active Directory audit works

Export: your team exports the NTLM hashes of the audited domain. Usernames are optional but enable the reuse analysis.
Scope: you provide the domain covered by your written authorization, the employees' main language and company-specific words, which tailor the wordlists.
Run 1: GPU recovery on the baseline export, then a PDF report with recovery rates, length distribution, reuse and remediation priorities.
Run 2: after remediation, for example six months later, a new export is audited with the same scope and compared with the baseline.

Unlimited NTLM hashes per run, one fixed price for both runs, and an optional white-label report. Full details and the intake form are on the Active Directory audit page.

Recovering access to company data

For a single protected file, the password recovery service starts with a free Basic Search. You see whether the password was found before paying to reveal it, and an incorrect unlocked password is refunded in full. Deeper searches use custom wordlists, rules or a targeted brute-force range, billed per GPU hour.

Security and data handling

Service data is hosted and processed within the European Union.
Recovery jobs run in isolated, short-lived containers.
Uploaded source files are deleted after hash extraction; audit hash files are deleted within 30 days of report delivery.
Payments are processed by Stripe; card data is not stored by OnlineHashCrack.

Share the Trust Center with your security or procurement team for the full list of controls.

Frequently asked questions

Why audit employee password hashes?

A password policy only states the rules. An audit of your own Active Directory hashes shows how many passwords could actually be recovered, which patterns employees use and which accounts share passwords, so remediation can target real risk.

Can the audit support ISO 27001, NIS2 or DORA compliance?

The Active Directory audit report maps findings to ISO 27001 Annex A.5.17, NIS2 Article 21 and DORA ICT risk management. It supports your audit evidence; it does not certify overall compliance.

Are plaintext passwords shared in the report?

No. Audit reports contain statistics and patterns, never plaintext passwords. Recovered-password files are deleted after report generation and uploaded hash files within 30 days of report delivery.

Can you recover a file left encrypted by a former employee?

Often, yes, when the organization owns the file and is authorized to access it. Submit the file or its hash; Basic Search is free and tells you whether the password was found before you pay to reveal it.

Who can order an enterprise audit?

The Active Directory audit requires a Tier 3 account verified on your company domain, and a written authorization covering the audited domain.

Know your real password risk

Start the Active Directory audit intake, or contact us if you need to discuss scope, procurement or a specific recovery case.

See the Active Directory audit