Password Hashing Demo

Entropy is a rough guess of how hard a password is to predict. In this demo, it is based on password length and the types of characters you use.

It checks password strength, turns text into a hash, and shows how adding salt changes the final result.

The browser takes what you type, converts it into bytes, and sends it to the Web Crypto API. The page then shows the result as hexadecimal text.

It means SHA-1 is no longer safe for real security use. Researchers showed that two different inputs can be made to produce the same hash. Once that is possible, the hash is no longer a reliable fingerprint, so SHA-1 should not be used for passwords or other security-sensitive work.

The salt changes the input before hashing. Even if the password stays the same, a new salt creates a different final hash.

A rainbow table attack uses a giant pre-made list of passwords and their hashes. Instead of guessing one by one, an attacker can look up a hash and see if it already matches a known password. Salts help stop this because the same password no longer gives the same hash for every user.