Someone told me that he has seen software systems that:
retrieve MD5 encrypted passwords from other systems;
decrypt the encrypted passwords and
store the passwords in the database of the system using the systems own algorithm.
Is that possible? I thought that it wasn't possible / feasible to decrypt MD5 hashes.
I know there are MD5 dictionaries, but is there an actual decryption algorithm?
No. MD5 is not encryption (though it may be used as part of some encryption algorithms), it is a one way hash function. Much of the original data is actually "lost" as part of the transformation.
Think about this: An MD5 is always 128 bits long. That means that there are 2128 possible MD5 hashes. That is a reasonably large number, and yet it is most definitely finite. And yet, there are an infinite number of possible inputs to a given hash function (and most of them contain more than 128 bits, or a measly 16 bytes). So there are actually an infinite number of possibilities for data that would hash to the same value. The thing that makes hashes interesting is that it is incredibly difficult to find two pieces of data that hash to the same value, and the chances of it happening by accident are almost 0.
A simple example for a (very insecure) hash function (and this illustrates the general idea of it being one-way) would be to take all of the bits of a piece of data, and treat it as a large number. Next, perform integer division using some large (probably prime) number n and take the remainder (see: Modulus). You will be left with some number between 0 and n. If you were to perform the same calculation again (any time, on any computer, anywhere), using the exact same string, it will come up with the same value. And yet, there is no way to find out what the original value was, since there are an infinite number of numbers that have that exact remainder, when divided by n.
That said, MD5 has been found to have some weaknesses, such that with some complex mathematics, it may be possible to find a collision without trying out 2128 possible input strings. And the fact that most passwords are short, and people often use common values (like "password" or "secret") means that in some cases, you can make a reasonably good guess at someone's password by Googling for the hash or using a Rainbow table. That is one reason why you should always "salt" hashed passwords, so that two identical values, when hashed, will not hash to the same value.
Once a piece of data has been run through a hash function, there is no going back.
You can't - in theory. The whole point of a hash is that it's one way only. This means that if someone manages to get the list of hashes, they still can't get your password. Additionally it means that even if someone uses the same password on multiple sites (yes, we all know we shouldn't, but...) anyone with access to the database of site A won't be able to use the user's password on site B.
The fact that MD5 is a hash also means it loses information. For any given MD5 hash, if you allow passwords of arbitrary length there could be multiple passwords which produce the same hash. For a good hash it would be computationally infeasible to find them beyond a pretty trivial maximum length, but it means there's no guarantee that if you find a password which has the target hash, it's definitely the original password. It's astronomically unlikely that you'd see two ASCII-only, reasonable-length passwords that have the same MD5 hash, but it's not impossible.
MD5 is a bad hash to use for passwords:
It's fast, which means if you have a "target" hash, it's cheap to try lots of passwords and see whether you can find one which hashes to that target. Salting doesn't help with that scenario, but it helps to make it more expensive to try to find a password matching any one of multiple hashes using different salts.
I believe it has known flaws which make it easier to find collisions, although finding collisions within printable text (rather than arbitrary binary data) would at least be harder.
I'm not a security expert, so won't make a concrete recommendation beyond "Don't roll your own authentication system." Find one from a reputable supplier, and use that. Both the design and implementation of security systems is a tricky business.
Technically, it's 'possible', but under very strict conditions (rainbow tables, brute forcing based on the very small possibility that a user's password is in that hash database).
But that doesn't mean it's
Viable
or
Secure
You don't want to 'reverse' an MD5 hash. Using the methods outlined below, you'll never need to. 'Reversing' MD5 is actually considered malicious - a few websites offer the ability to 'crack' and bruteforce MD5 hashes - but all they are are massive databases containing dictionary words, previously submitted passwords and other words. There is a very small chance that it will have the MD5 hash you need reversed. And if you've salted the MD5 hash - this won't work either! :)
The way logins with MD5 hashing should work is:
During Registration:
User creates password -> Password is hashed using MD5 -> Hash stored in database
During Login:
User enters username and password -> (Username checked) Password is hashed using MD5 -> Hash is compared with stored hash in database
When 'Lost Password' is needed:
2 options:
User sent a random password to log in, then is bugged to change it on first login.
or
User is sent a link to change their password (with extra checking if you have a security question/etc) and then the new password is hashed and replaced with old password in database
Not directly. Because of the pigeonhole principle, there is (likely) more than one value that hashes to any given MD5 output. As such, you can't reverse it with certainty. Moreover, MD5 is made to make it difficult to find any such reversed hash (however there have been attacks that produce collisions - that is, produce two values that hash to the same result, but you can't control what the resulting MD5 value will be).
However, if you restrict the search space to, for example, common passwords with length under N, you might no longer have the irreversibility property (because the number of MD5 outputs is much greater than the number of strings in the domain of interest). Then you can use a rainbow table or similar to reverse hashes.
Not possible, at least not in a reasonable amount of time.
The way this is often handled is a password "reset". That is, you give them a new (random) password and send them that in an email.
You can't revert a md5 password.(in any language)
But you can:
give to the user a new one.
check in some rainbow table to maybe retrieve the old one.
No, he must have been confused about the MD5 dictionaries.
Cryptographic hashes (MD5, etc...) are one way and you can't get back to the original message with only the digest unless you have some other information about the original message, etc. that you shouldn't.
Decryption (directly getting the the plain text from the hashed value, in an algorithmic way), no.
There are, however, methods that use what is known as a rainbow table. It is pretty feasible if your passwords are hashed without a salt.
MD5 is a hashing algorithm, you can not revert the hash value.
You should add "change password feature", where the user gives another password, calculates the hash and store it as a new password.
There's no easy way to do it. This is kind of the point of hashing the password in the first place. :)
One thing you should be able to do is set a temporary password for them manually and send them that.
I hesitate to mention this because it's a bad idea (and it's not guaranteed to work anyway), but you could try looking up the hash in a rainbow table like milw0rm to see if you can recover the old password that way.
See all other answers here about how and why it's not reversible and why you wouldn't want to anyway.
For completeness though, there are rainbow tables which you can look up possible matches on. There is no guarantee that the answer in the rainbow table will be the original password chosen by your user so that would confuse them greatly.
Also, this will not work for salted hashes. Salting is recommended by many security experts.
No, it is not possible to reverse a hash function such as MD5: given the output hash value it is impossible to find the input message unless enough information about the input message is known.
Decryption is not a function that is defined for a hash function; encryption and decryption are functions of a cipher such as AES in CBC mode; hash functions do not encrypt nor decrypt. Hash functions are used to digest an input message. As the name implies there is no reverse algorithm possible by design.
MD5 has been designed as a cryptographically secure, one-way hash function. It is now easy to generate collisions for MD5 - even if a large part of the input message is pre-determined. So MD5 is officially broken and MD5 should not be considered a cryptographically secure hash anymore. It is however still impossible to find an input message that leads to a hash value: find X when only H(X) is known (and X doesn't have a pre-computed structure with at least one 128 byte block of precomputed data). There are no known pre-image attacks against MD5.
It is generally also possible to guess passwords using brute force or (augmented) dictionary attacks, to compare databases or to try and find password hashes in so called rainbow tables. If a match is found then it is computationally certain that the input has been found. Hash functions are also secure against collision attacks: finding X' so that H(X') = H(X) given H(X). So if an X is found it is computationally certain that it was indeed the input message. Otherwise you would have performed a collision attack after all. Rainbow tables can be used to speed up the attacks and there are specialized internet resources out there that will help you find a password given a specific hash.
It is of course possible to re-use the hash value H(X) to verify passwords that were generated on other systems. The only thing that the receiving system has to do is to store the result of a deterministic function F that takes H(X) as input. When X is given to the system then H(X) and therefore F can be recalculated and the results can be compared. In other words, it is not required to decrypt the hash value to just verify that a password is correct, and you can still store the hash as a different value.
Instead of MD5 it is important to use a password hash or PBKDF (password based key derivation function) instead. Such a function specifies how to use a salt together with a hash. That way identical hashes won't be generated for identical passwords (from other users or within other databases). Password hashes for that reason also do not allow rainbow tables to be used as long as the salt is large enough and properly randomized.
Password hashes also contain a work factor (sometimes configured using an iteration count) that can significantly slow down attacks that try to find the password given the salt and hash value. This is important as the database with salts and hash values could be stolen. Finally, the password hash may also be memory-hard so that a significant amount of memory is required to calculate the hash. This makes it impossible to use special hardware (GPU's, ASIC's, FPGA's etc.) to allow an attacker to speed up the search. Other inputs or configuration options such as a pepper or the amount of parallelization may also be available to a password hash.
It will however still allow anybody to verify a password given H(X) even if H(X) is a password hash. Password hashes are still deterministic, so if anybody has knows all the input and the hash algorithm itself then X can be used to calculate H(X) and - again - the results can be compared.
Commonly used password hashes are bcrypt, scrypt and PBKDF2. There is also Argon2 in various forms which is the winner of the reasonably recent password hashing competition. Here on CrackStation is a good blog post on doing password security right.
It is possible to make it impossible for adversaries to perform the hash calculation verify that a password is correct. For this a pepper can be used as input to the password hash. Alternatively, the hash value can of course be encrypted using a cipher such as AES and a mode of operation such as CBC or GCM. This however requires the storage of a secret / key independently and with higher access requirements than the password hash.
MD5 is considered broken, not because you can get back the original content from the hash, but because with work, you can craft two messages that hash to the same hash.
You cannot un-hash an MD5 hash.
There is no way of "reverting" a hash function in terms of finding the inverse function for it. As mentioned before, this is the whole point of having a hash function. It should not be reversible and it should allow for fast hash value calculation. So the only way to find an input string which yields a given hash value is to try out all possible combinations. This is called brute force attack for that reason.
Trying all possible combinations takes a lot of time and this is also the reason why hash values are used to store passwords in a relatively safe way. If an attacker is able to access your database with all the user passwords inside, you loose in any case. If you have hash values and (idealistically speaking) strong passwords, it will be a lot harder to get the passwords out of the hash values for the attacker.
Storing the hash values is also no performance problem because computing the hash value is relatively fast. So what most systems do is computing the hash value of the password the user keyed in (which is fast) and then compare it to the stored hash value in their user database.
You can find online tools that use a dictionary to retrieve the original message.
In some cases, the dictionary method might just be useless:
if the message is hashed using a SALT message
if the message is hash more than once
For example, here is one MD5 decrypter online tool.
The only thing that can be work is (if we mention that the passwords are just hashed, without adding any kind of salt to prevent the replay attacks, if it is so you must know the salt)by the way, get an dictionary attack tool, the files of many words, numbers etc. then create two rows, one row is word,number (in dictionary) the other one is hash of the word, and compare the hashes if matches you get it...
that's the only way, without going into cryptanalysis.
The MD5 Hash algorithm is not reversible, so MD5 decode in not possible, but some website have bulk set of password match, so you can try online for decode MD5 hash.
Try online :
MD5 Decrypt
md5online
md5decrypter
Yes, exactly what you're asking for is possible.
It is not possible to 'decrypt' an MD5 password without help, but it is possible to re-encrypt an MD5 password into another algorithm, just not all in one go.
What you do is arrange for your users to be able to logon to your new system using the old MD5 password. At the point that they login they have given your login program an unhashed version of the password that you prove matches the MD5 hash that you have. You can then convert this unhashed password to your new hashing algorithm.
Obviously, this is an extended process because you have to wait for your users to tell you what the passwords are, but it does work.
(NB: seven years later, oh well hopefully someone will find it useful)
No, it cannot be done. Either you can use a dictionary, or you can try hashing different values until you get the hash that you are seeking. But it cannot be "decrypted".
MD5 has its weaknesses (see Wikipedia), so there are some projects, which try to precompute Hashes. Wikipedia does also hint at some of these projects. One I know of (and respect) is ophrack. You can not tell the user their own password, but you might be able to tell them a password that works. But i think: Just mail thrm a new password in case they forgot.
In theory it is not possible to decrypt a hash value but you have some dirty techniques for getting the original plain text back.
Bruteforcing: All computer security algorithm suffer bruteforcing. Based on this idea today's GPU employ the idea of parallel programming using which it can get back the plain text by massively bruteforcing it using any graphics processor. This tool hashcat does this job. Last time I checked the cuda version of it, I was able to bruteforce a 7 letter long character within six minutes.
Internet search: Just copy and paste the hash on Google and see If you can find the corresponding plaintext there. This is not a solution when you are pentesting something but it is definitely worth a try. Some websites maintain the hash for almost all the words in the dictionary.
MD5 is a cryptographic (one-way) hash function, so there is no direct way to decode it. The entire purpose of a cryptographic hash function is that you can't undo it.
One thing you can do is a brute-force strategy, where you guess what was hashed, then hash it with the same function and see if it matches. Unless the hashed data is very easy to guess, it could take a long time though.
It is not yet possible to put in a hash of a password into an algorithm and get the password back in plain text because hashing is a one way thing. But what people have done is to generate hashes and store it in a big table so that when you enter a particular hash, it checks the table for the password that matches the hash and returns that password to you. An example of a site that does that is http://www.md5online.org/ . Modern password storage system counters this by using a salting algorithm such that when you enter the same password into a password box during registration different hashes are generated.
No, you can not decrypt/reverse the md5 as it is a one-way hash function till you can not found a extensive vulnerabilities in the MD5.
Another way is there are some website has a large amount of set of password database, so you can try online to decode your MD5 or SHA1 hash string.
I tried a website like http://www.mycodemyway.com/encrypt-and-decrypt/md5 and its working fine for me but this totally depends on your hash if that hash is stored in that database then you can get the actual string.
When I choose password encryption, I have found that Rijndael algorithm is one of the best encryption which cannot be cracked through brute force attack.
So I have choosen Rijndael algorithm for user's password encryption.
Now I have identified that, hashing (Irreversible) is more secure than encryption (Reversible) [Please correct me if I am wrong]
Here my question is,
Can I go with the existing implementation Rijndael algorithm
If I should not do encryption, Which one should be a best hashing algorithm.
I have referred the following website when implementing Rijndael algorithm.
http://msdn.microsoft.com/en-us/library/system.security.cryptography.rijndael(v=vs.110).aspx
How to generate Rijndael KEY and IV using a passphrase?
http://www.obviex.com/samples/encryption.aspx
OWASP lists some good practices for password storage.
You basically apply a protection_function to convert the credential to a protected form:
[protected form] = [salt] + protect([protection func], [salt] + [credential]);
You also add a salt so two versions of the same credential have a different stored form.
They also list the order in which you should choose hashing functions (yes, hashing is better than encrypting so that the password cannot be reverse engineered, even by the website owner). Argon2 and PBKDF are generally good choices for a protection_function.
Read the rest of the guide too. Also this related Security SE post about why AES (i.e. Rijndael) encrypted password storage is worse than even a not-so-strong hash (#Salvador's comment).
The problem with encryption is, that when an attacker get the key, he can decrypt all passwords of the database in no time, and therefore knows the original passwords which can be tried on other sites.
Since hashing is irreversible (there is no way to get back the original password), an attacker cannot use the hashes, even if he has control over the server. The same goes for the owner of the site.
Today recommended algorithms are BCrypt, PBKDF2 and SCrypt, all of them have a cost factor which controls the necessary time to calculate a single hash. The longer it needs, the more difficult it will be to brute-force.
I am working on Database where some of the Encrypted data I inserted in the database must be decrypted to be shown to the user. Is it possible to convert a decrypted message/varchar entry in the database to their Orginal or String form? let's say I have this hashed message
`abc = `'7meXQAMRb+ERvBj6Dy/SEe6ldukGy6bTKugnCsoYyl+lYNT6';
is there anyway to return that 7meXQAMRb+ERvBj6Dy/SEe6ldukGy6bTKugnCsoYyl+lYNT6 back to abc again?
Btw I used Omu Encrypto for Encrypting my password
No, you cannot decrypt data that has been hashed.
That's the entire point of hashing information; it's a one way process most of the time.
You can use what's called a Rainbow attack to brute force some inputs and see if the hashes match, but to be honest that takes a long time and is probably not what you're looking for.
See Eric J's answer for more details.
One cannot reverse a hashed password reliably into the original string. However, it IS possible to reconstruct SOME valid input that yields a given hash. I'm providing this answer because the other answers are only partially correct, and it is important to understand the relative security of a hash.
To understand this, assume you use a 1-bit hash algorithm (that is, the hash is either 1 or 0). Half of all strings that you hash will yield a "1". Expand that to a 2-bit hash, and 1-in-4 strings that you randomly hash will yield a given hash value (hashes will be 0, 1, 2, or 3... in binary 00, 01, 10, 11). Expand that to say 128 bits and, while hash collisions are FAR less common, they still occur. If your hash algorithm has known vulnerabilities, it can be computationally straightforward to defeat it.
The MD5 has, for example, can be attacked using Rainbow Tables. There are online services that offer hash "cracking" e.g. http://md5crack.com/. Here, cracking means to reconstruct SOME valid input that yields the hash. Even brute force cracking is viable with modern processing power, especially using a GPU-based approach and/or distributed computing.
Hashes are a great tool, but be aware of your security requirements and the relative ease of reversing a hash generated by your chosen hash algorithm into some valid input that yields that hash. Also, always be sure and use a salt value with your hash.
UPDATE
Now that the question has been re-written, I would refer you to AES encryption. See
Using AES encryption in C#
Hashes are one-way, but if you used a third party encryption method like you said, they should provide a decryption method as well.
I am trying to get back a string from its hash value?
string str="Hello";
int hashStr=str.GetHashCode(); // hash value of "Hello" is -694847
can I get back my_string (i.e "Hello") form the hashed value....?
UPDATED
actually i am thinking to save password into my database after hashing to make it secure...
So it means a different password even have same value?
There are exactly 2^32 many hash codes but way, way more strings. Thus, by the pigeonhole principle, there have to be multiple strings mapping to the same hash code. Therefore, an inverse map from hash code to string is impossible
Edit: Response to your update.
actually i am thinking to save password into my database after hashing to make it secure...
So it means a different password even have same value?
Yes, it is possible for two passwords to have the same hash. This is basically a restatement of the above. But you shouldn't use GetHashCode to hash the password. Instead, use something secure like SHA-2.
To go one step further, never try to roll your own your encryption/security etc. Find a library that does it for you.
actually I am thinking to save password into my database after hashing to make it secure
You are not competent to implement this code.
That's nothing to feel bad about. I'm not competent to do so either, and I've studied security systems for years. By studying security systems I've learned that security systems are insanely difficult to get right, require years of experience and detailed expertise of a complex domain. That's how I know I'm not competent. The fact that you think that hashes might be reversible indicates to me that you are not a security professional.
My advice: hire a security professional to do this task for you. There is no point in spending good money to make a bad security system that doesn't actually protect your resources. Rather than rolling your own cheap system now and spending a lot more money on cleaning up the disaster later, spend a little more up front now and get a professional implementation.
Furthermore, the documentation for GetHashCode specifically states that it is not suitable to be used for password hashing because the algorithm could be changed at any time. In fact the hash algorithm did change between CLR v1 and CLR v2, and that broke every single vendor who relied upon GetHashCode for a password hash who upgraded their system. GetHashCode is not stable, it is not secure, it is not crypto strength and it is not based on any industry standard algorithm. DO NOT UNDER ANY CIRCUMSTANCES use it for crypto hashing.
One answer that is missing here is explaining to the OP that hashing is not encryption. The terms hashing and cryptography are often confusing for junior programmers (myself included at one point) who need to deal with security for the first time.
From Wikipedia: A hash function is any well-defined procedure or mathematical function that converts a large, possibly variable-sized amount of data into a small datum, usually a single integer that may serve as an index to an array (cf. associative array). The values returned by a hash function are called hash values, hash codes, hash sums, checksums or simply hashes.
From Wikipedia: Encryption is the process of transforming information (referred to as plaintext) using an algorithm (called cipher) to make it unreadable to anyone except those possessing special knowledge, usually referred to as a key.
Edit for Update:
Yes. Though unlikely and highly dependent on the type of hash algorithm, hashing of two or more different pieces of data could yield the same value.
Password hashing is often used to secure passwords in a database. But, you cannot un-hash passwords. If you want to hash them you have to evaluate the hash values to make sure they match. Here's and ASP-specific strategy for hashing passwords. Here is a good read, especially if you're working with web technologies
Something not mentioned in here is you should salt your hashes.. yum yum.
What a salt is/does.
Lets say you get a hold of someone's DB full of hashed passwords. If they hashed with no salt, then "breaking" passwords would be as easy as downloading a large pre-hashed dataset of a crap-ton of strings.
If the hash from one string matches, then you have a good chance of knowing the password. Even if it's not the correct password, you can still log in with it since it gives the same hash.
This is where salting your hashes comes in. If you add a salt (aka pre-determined random string) to a password before it is hashed, then you can't just pre-hash a ton of strings
example.
No Salt:
Password: ABCD hashes into 1234EFG
Large list of pre-hashed strings hash a hash of 1234EFG, may or may not be ABCD, but it will still work.
With Salt:
Password: ABCD concat 0315927429 hashes into 43BCF1
Each password has a different salt, so you can't use one pre-computer hash lookup table, you'd have to re-compute the hashes for every password.
Re-computing would incredibly time consuming. Now, the salt doesn't have to be securely stored for it to add lots of this benefit. Even if you store the salt in the same table, it would be incredibly hard for anyone to make a hash lookup to try to reverse any one person's password.
To other responder: "One answer that is missing here is explaining to the OP that hashing is not encryption."
Hashes are sometimes refereed to as "One way encryption". This is a bad description and adds to the confusion you mentioned.
As others said, in general you can't do it as string to hash isn't a one-to-one function; infinite number of strings but only 2^32 ~ 4 billion hashes. That said, you can do a dictionary attack against an unsalted hash. Get a cluster of computers to calculate hashes for a wide variety of likely strings (e.g., dictionary words) and find a hash that matches.
The short answer to your question is : No. The hash is just one way.
If you want to secure your password as you said in the update, hash it with a hashing algorithmic (MD5, SHA1, ...) then stored in the database. When you want to verify the password given by the user, just hash it and compared to the hash stored in the database.
actually i am thinking to save
password into my database after
hashing to make it secure...
So it means a different password even
have same value?
GetHashCode is not a Cryptographic hash function, so it isn't really appropriate for this purpose.
Yes, different passwords will have the same value. Even so, this still makes the user's passwords more secure, though this can safely be done client-side rather than server-side for improved protection. The purpose of hashing passwords before storing them is to make sure your database* cannot be used to determine a user's passwords. A user could still use the hashes stuck in your database to pose as your users, but knowing a user's actually site password is more valuable, since a good chunk of your users will use the same passwords everywhere else.
*There are other similar attacks this protects against like man-in-the-middle attacks, but in general it's all about ensuring you don't store a user's password in your database in plain text.
You can't get back value from hashed value, but what you can do (and this is what is done in almost every website that saves hashed passwords) is to compare the hash of the just-entered password to the hash you've saved.
And about your second question, it is true that there can be more than one text to match one hash, but it's not like the hash of "hello" is equals to the hash of "goodbye". It's more like the hash of "hello" is equals to the hash of "sdd89sfu7w84haushf9478hfsklehf84hfwuhf...".
Don't use GetHashCode() to hash a password. It isn't a cryptographic hash and it's resulting hash way too short. GetHashCode is designed for use in HashTables and similar structures. A GetHashCode() which returns a constant value is valid(but slows down hashtables a lot).
For password-hashing there are several pitfalls:
Use a salt, so an attacker can't use rainbowtables(or similar pre-calculation attacks)
Use many iterations to slow down bruteforce attacks
Use a cryptographic hashfunction
You better not implement it yourself, but instead use a standard Key Derivation Function (KDF) such as PBKDF2.
The .net framework contains classes to do this for you:
Rfc2898DeriveBytes implements PBKDF2
PasswordDeriveBytes implements PBKDF1
To check if the entered password is correct, you don't decrypt the saved password(which isn't possible), but you hash the entered password with the same salt as the original password, and then compare the hash.