Rainbow Table
A rainbow table is a precomputed table improved by Martin Hellman for inverting hash functions, trading space for time in a time-space trade-off to crack password hashes.
Purpose
Massively reduces storage via precomputed hash chains, efficiently cracking unsalted password hashes under a time-space trade-off.
Mechanism
Precomputes hash chains: repeatedly hash-and-reduce from a start point to an end point, storing only endpoints. To look up, repeatedly reduce-and-hash from the target hash to match an endpoint, then rebuild the chain from the start point to find the preimage. Salt forces an independent rainbow table per user, making precomputation infeasible.
Use cases
- Cracking unsalted LM/NTLM hashes
- Password hash security education
- Ophcrack tool
- Security audits
Examples
- Input
MD5 without saltOutput8-character alphabetic password cracked in secondsSalt defeats rainbow tables
Common errors
- Storing password hashes without salt
- Unique per-user salt + slow hash
Related terms
MD5
MD5 is a 128-bit cryptographic hash function designed by Ronald Rivest; proven insecure by collision attacks, it is now used only for non-security purposes such as checksums. GLOSSARY
SHA-256
SHA-256 is the 256-bit-output member of the SHA-2 family, widely used in TLS, blockchains, and cryptographic applications, with no known practical attacks. GLOSSARY
Salt
A salt is a random value added during password hashing so identical passwords produce different hashes, defeating rainbow tables and same-password detection. GLOSSARY
Hash Salting
Hash salting is adding a random salt to the hash input so identical inputs produce different hashes, defeating rainbow tables and collision detection. GLOSSARY