Solutions / Managed service providers
Password Audits for Managed Service Providers
Weak passwords are behind many of the incidents your clients ask you to prevent. Turn password auditing into a repeatable, white-label engagement you can sell to each client, without building cracking infrastructure.
For MSPs, MSSPs and IT outsourcing firms, on client data covered by written authorization.
In short
- A sellable deliverable: baseline and follow-up audit with a PDF report your clients understand.
- Your brand: white-label reports without OHC branding.
- Compliance value: findings mapped to NIS2, ISO 27001 and DORA controls.
- Automation: REST API and MCP server for recovery tasks inside your own tooling.
How MSPs use OnlineHashCrack
Periodic security review
Each audit covers a baseline and a follow-up run. Schedule a new audit for later reviews to show each client how its exposure changes over time.
Onboarding a new client
Measure password risk on day one, set a baseline, and use it to justify the hardening plan you propose.
Support tickets
Recover access to a client-owned file or archive locked by a lost password, without escalating to a specialist.
Why it works as a managed service
- No infrastructure: GPU capacity is on demand, so there is no hardware to amortize across clients.
- Fixed audit price: one price covers both runs with unlimited NTLM hashes, which makes your own margin easy to set.
- Per-client scoping: each audit covers one authorized domain, with its own report and its own data retention schedule.
- Measurable outcome: the follow-up run shows the effect of the remediation you delivered.
Client data handling
Reports never contain plaintext passwords. Recovered-password files are deleted after report generation, and uploaded hash files within 30 days of report delivery. Service data is hosted and processed within the European Union. Point your clients to the Trust Center for the full list of controls.
Authorization
Every audit must be covered by the client's written authorization for the audited domain or data. OnlineHashCrack can refuse or stop processing when authorization is doubtful. See the Terms & Conditions.
Frequently asked questions
Can an MSP run password audits for its clients?
Yes, when each client has given written authorization for the audited domain or data. Each audit is scoped to one client domain, so findings stay separated between clients.
Can I deliver the report under my own brand?
Yes. The Active Directory audit has a white-label option that removes OHC branding from the PDF and can add your logo, for client-facing delivery.
Can password audits be automated across clients?
Hash submissions and results are available through the authenticated REST API and the MCP server, so audits and recovery tasks can be built into your own tooling. API access requires Tier 2 verification.
Is it useful for NIS2 clients?
The audit report maps findings to NIS2 Article 21, ISO 27001 Annex A.5.17 and DORA ICT risk management, which helps clients document authentication controls. It does not certify compliance.
What do I need to open an MSP account?
An account on your company domain with Tier 3 domain verification, which unlocks the full algorithm catalogue and the Active Directory audit. Contact us if you expect regular volume.
Add password audits to your service catalogue
Review the Active Directory audit, or contact us if you plan regular volume across several clients.
Discuss volume