Crack hashes.
Distributed. Parallel. Auditable.
A cluster of Rust workers, coordinated by an Actix-Web server and secured by a Java authentication provider. Jobs are stored in SurrealDB, while workers discover the cluster over a shared Tailscale/Headscale network with MagicDNS.
$ cargo run --release -p server Compiling server v0.0.1 Finished release [optimized] [INFO] HttpCrackingServer listening on 127.0.0.1:6667 [vpn ] joined crackjack.tailnet via Headscale [dns ] workers resolved through MagicDNS [db ] SurrealDB job job_7f31 loaded hash_type=SHA-256 [auth ] POST /token/verify -> valid [worker] node-01 joined cores=8 arch=aarch64 [worker] node-02 joined cores=16 arch=x86_64 [http ] accepted request job_id=job_7f31 token=present [job ] dispatched chunks=24 workers=2 [hit ] worker=node-02 plain="hunter2" Δ=842ms
Simulated Brute-Force Cracking
This demo runs entirely in the browser — each worker increments through a text range and reports attempts until the first hit.
- attempts
- 0
- status
- idle
- workers
- 3
Job records, verified requests, one cluster.
The dashboard stores hash data in SurrealDB, then asks the central cracking station to start a job by sending its job id and an identification token. The server verifies that request through the auth provider before distributing work to connected workers.
- › Creates the cracking job
- › Writes hash data into SurrealDB
- › Calls the server with job_id and token
HTTP request: ?job_id=...- › Users, Roles, Sessions
- › Identification token checks
- › Request validity decisions
POST /token/verify- › Loads the job from SurrealDB
- › Verifies requests through auth
- › Workers join via VPN and MagicDNS
shared network: Tailscale/Headscale + MagicDNSTech Stack
Who uses Cracking Station?
From forensic analysts to academic researchers — anyone who needs distributed hash recovery at scale.
Recover access to encrypted evidence files and password-protected archives for law enforcement and investigative teams.
Validate password policy strength by testing real hashes against modern cracking techniques at cluster scale.
Solve capture-the-flag challenges at speed. Distribute work across the cluster and get results in seconds, not hours.
Help users regain access to their own encrypted files or accounts — with a full audit trail for every job.
Benchmark hash algorithms, study computational complexity, and publish reproducible cracking experiments.
During a breach investigation, quickly identify compromised credentials from leaked hash databases before attackers do.
Frequently asked questions
A quick overview of the project scope, current status, and intended use.
What is CrackJack built for?+
CrackJack is a distributed password-cracking platform designed for demos, research, and educational environments. It shows how cracking jobs are coordinated across multiple workers and how the system can be observed and extended over time.
Is CrackJack ready for production use?+
Not yet. The current version is a student project and technical prototype focused on architecture, experimentation, and transparent system behavior rather than production hardening.
How does distributed cracking work in CrackJack?+
The platform splits the search space into smaller chunks and distributes them across connected workers. A central server coordinates the job, workers process their assigned tasks, and results are returned once a match is found or the search is exhausted.
Which hash types are supported?+
CrackJack currently lists MD5, SHA-1, SHA-256, bcrypt, and Argon2id as implemented hash types.
Who is this project intended for?+
CrackJack is especially suited for university teams, security labs, teaching environments, and technical demos where observability, architecture, and distributed execution are central topics.
How can I contact the team?+
You can find the contact details on the About page, including the project email and institutional information.