Password Recovery for Law Enforcement and Digital Forensics

In short

• Submit the hash, not the evidence: extract the hash from your forensic working copy and send only that. The readable content never leaves your lab.
• GPU capacity on demand: 221 supported hash modes, run on cloud GPUs with no hardware to buy, cool or maintain.
• Bounded retention: uploaded files are deleted after hash extraction, and task data is kept for up to 12 months under the Privacy Policy.
• Lawful use only: every task must be covered by a mandate or another valid legal basis. Institutional accounts are verified by domain.

Why investigators use a cloud recovery service

Password-protected files now appear in most digital investigations: encrypted documents, archives, password managers and disk containers. In-house forensic labs rarely have dedicated GPU hardware for every case, and the hardware they have is shared across a growing backlog. A recovery attempt that waits for a free workstation delays the whole investigation.

OnlineHashCrack removes that bottleneck. Examiners keep acquisition, analysis and reporting in their own tools, and use the platform only for the compute-heavy step: testing candidate passwords against a hash at GPU speed.

Typical investigation cases

Incident response teams use the same workflow after a breach: recovering passwords from protected files left by an attacker, or measuring how many compromised account hashes were weak enough to be reused.

A workflow that respects the evidence

1. Work on a copy. Keep the original exhibit sealed and work from your verified forensic image, as your procedures require.
2. Extract the hash locally. Use your usual forensic tools to extract the password hash. Only that hash is submitted; it does not contain the readable data.
3. Add case context. Names, dates, known passwords and language from the investigation can be turned into a custom wordlist or a targeted search, which is often what turns a long search into a quick one.
4. Run staged searches. Fast dictionary checks first, then deeper searches only when the case justifies the cost.
5. Verify and document. Test the recovered password on your working copy and record the task reference, date and outcome in your case notes.

Confidentiality and data handling

• Data minimization: hash-only submission means the platform never needs the document, the mailbox or the disk image itself.
• Short-lived processing: recovery jobs run in isolated containers that are terminated after completion.
• Restricted results: recovered passwords are visible only to the submitting account, and email notifications show only a masked excerpt.
• Retention limits: uploaded files are deleted after hash extraction; hashes, tasks and results are kept for up to 12 months. The Privacy Policy lists the limited cases where data may be kept longer.

The full list of controls is published in the Trust Center. It describes the service's practices; it is not a certification and does not replace your agency's own assessment.

Legal framework

OnlineHashCrack is for authorized use only. For investigators, that means a lawful mandate or another valid legal basis that covers the material and the recovery, used within its scope. Requests that look outside that scope can be refused or stopped. Accounts are verified in tiers; agencies should register with an institutional email address and request Tier 3 domain verification to unlock the full algorithm catalogue. The Terms & Conditions apply to every account.

Cost and turnaround

Basic Search is free and tells you whether a password was found before you pay to reveal it. Deeper searches are billed per GPU hour, with the price shown before you confirm. Standard tasks run for up to 3 days, and urgent tasks can be moved to the front of the queue. Details are on the pricing page. If your procurement rules need something other than card payment, contact us.