md5 reverse lookup

In the simplest terms: 69656a261ced550817c408c2483be96e

MD5 sums (see RFC 1321 - The MD5 Message-Digest Algorithm) are used as a one-way hash of data. Due to the nature of the formula used, it is impossible to reverse it. To find out what the source data was, one would traditionally attempt every single possible input value until they found the solution.

Even on fast machines this is difficult. To find the input value for a single MD5 will take some two weeks.

Using the disk space / speed trade-off, this database was started.

Scanning the tables for a match will take longer as the database grows. However to offset this the database has been split into several tables so that a single search will not need to traverse more than 1/256th of the solution set when the database is complete. Should this not be fast enough, the database can be split up further using a branching tree algorithm.

Multiple inputs may end up with the same message digest. This possibility is taken into account and all matches are displayed - not just the first.

security

We are not breaking security. We are however making it easier to lookup the source of a MD5 sum.

To make your product more secure we recommend you take the following steps:

• Use a longer salt. eg: ``password:saltsaltsaltsalt''. As we only cover the american-english dictionary and combinations up to four letters long, long plain texts will not be found in the database.
• MD5 twice. A sample formula: MD5( MD5( password + salt ) + password ). This is much stronger as two MD5s must be looked up, again decreasing the chances it is in the database.

phpBB is one popular product that does not salt its passwords. If you use a short password on a phpBB message board then we have it listed in our database.

rant

This exercise in computer science is probably illegal under the DMCA. Our remote tropical location of New Zealand should make things more interesting should lawyers come in pursuit of us. Thanks to Comrade Helen Clark throwing away New Zealand's sovereignty, we'll probably be extradited and sued all the same.

Hooray for stupid laws and the loss of sovereignty!

Written by Stephen D Cope. Copyright (c) 2003-2004 Stephen D Cope. Distributed under the GNU GPL.