Password Hashing Demo
See exactly why your password can't be un-hashed. A live PBKDF2-HMAC-SHA-256 demo, avalanche effect visualisation, and a simulated stolen-database attack — all running in-browser via the Web Crypto API. Nothing leaves your tab.
Security theory you can touch.
Live hashing lab
Type a password and watch PBKDF2-HMAC-SHA-256 run 100,000 iterations in real-time. Tweak the salt, watch the hash change entirely. The output length, character pool, and cost are all shown.
Avalanche effect
Change one character in your password. The resulting hash looks nothing like the original. This visual makes the one-way property of cryptographic hashes immediately intuitive.
Database attack sim
Run a simulated cracker against a demo hash using common passwords. It burns through a limited guess budget and fails — showing exactly why salted hashes resist database breaches.
Hashing isn't encryption.
One-way functions
Encryption is reversible — you encrypt with a key and decrypt with a key. Hashing is not. A hash function takes your password and produces a fixed-length digest. There's no "unhash" operation — you can only hash a guess and check if it matches.
This is why responsible services don't store your password. They store the hash. When you log in, they hash what you typed and compare. If the database leaks, attackers don't have passwords — they have expensive puzzles.
password124 → 2aa60a8ff7fcd473d321e0146afd9e26
Password123 → c7ad44cbad762a5da0a452f9e854fdc1