Skip to content
OnlineHashCrack

Solutions / Penetration testers & security firms

Cloud Hash Cracking for Penetration Testers and Security Firms

Turn the hashes collected during an engagement into findings your client understands, without carrying a GPU rig to every mission. OnlineHashCrack runs the cracking phase on cloud GPUs while you keep testing.

For contracted pentests, red team exercises and security assessments.

Submit hashes API & MCP documentation

In short

  • 221 hash modes, including the Windows, Kerberos, Wi-Fi and web formats that appear in most engagements.
  • No hardware overhead: no rig to ship, power or keep up to date between missions.
  • Automation: REST API and MCP server to submit hashes and fetch results from your own tooling.
  • Pay per need: free Basic Search, then GPU time only when a finding is worth a deeper search.

Where it fits in an engagement

Internal and Active Directory tests

NTLM, NetNTLM, Kerberos and cached domain credential hashes, to show how far weak passwords take an attacker inside the domain.

Wireless assessments

WPA PMKID and handshake captures from an authorized site survey, to test whether the network passphrase resists offline attacks.

Application and database tests

Password hashes found in an application database or backup, to measure the real impact of a data exposure finding.

What it changes for your team

  • Faster reports: start cracking as soon as hashes are collected and have results while you test other scope items.
  • Stronger findings: a recovery rate and examples of weak patterns are more convincing than "password policy could be improved".
  • Targeted searches: add client-specific words, such as company name, products or city, to a custom wordlist; rule-based and mask searches cover typical patterns like Company2026!.
  • Predictable cost: GPU time is priced per hour and confirmed before it runs, so it can be built into the engagement quote.

Active Directory password audit for your clients

For a deliverable rather than a single task, the Active Directory password audit covers two runs: a baseline and a second run after remediation. Each run produces a PDF report with recovery rates, password length and reuse statistics, and mapping to ISO 27001, NIS2 and DORA controls. Plaintext passwords never appear in the report, and a white-label option removes OHC branding for client delivery. The audit requires Tier 3 domain verification.

API and MCP automation

The authenticated API accepts hash and file submissions and returns task status and results, so cracking can be one step of your own pipeline. The MCP server exposes the same functions to AI assistants such as Claude or ChatGPT. API access starts at Tier 2.

Only submit hashes collected within a signed engagement, and keep them inside the agreed scope. Submissions without explicit authorization from the data owner are prohibited by the Terms & Conditions. Uploaded files are deleted after hash extraction, and task data is kept for up to 12 months; see the Trust Center for details you can share with clients.

Frequently asked questions

Can I use OnlineHashCrack during a penetration test?

Yes, when the hashes come from an engagement covered by a written authorization or contract, and stay within its scope. Many pentest and red team consultancies use the platform for the cracking phase of their assessments.

Which hash types are relevant for pentesters?

Common engagement formats include NTLM, NetNTLMv1 and v2, Kerberos 5 TGS-REP and AS-REP, MS Cache 2, WPA PMKID and EAPOL captures, and web application hashes such as bcrypt or salted SHA. The supported formats page lists every mode with an example.

Can I automate submissions from my tooling?

Yes. The authenticated REST API and the MCP server let you submit hashes and read results from scripts or AI assistants. API access requires Tier 2 verification.

Is a cracked password included in my report?

That is your decision. For client reporting, most testers show statistics and masked examples instead of plaintext passwords. The Active Directory audit offer produces PDF reports that never contain plaintext passwords.

Does a hash that was not cracked mean the password is strong?

No. It only means the search that ran did not find it within the selected options and time. Report it as a limit of the test, not as proof of strength.

Start with a free Basic Search

Paste up to five hashes or upload a capture. You see whether a password was found before you decide to pay.

Submit hashes