HFU · SoSe 2026 · Distributed Cracking Station

Crack hashes.
Distributed. Parallel. Auditable.

A cluster of Rust workers, coordinated by an Actix-Web server and secured by a Java authentication provider. Jobs are stored in SurrealDB, while workers discover the cluster over a shared Tailscale/Headscale network with MagicDNS.

cracker — server
$ cargo run --release -p server
   Compiling server v0.0.1
   Finished release [optimized]
[INFO] HttpCrackingServer listening on 127.0.0.1:6667
[vpn  ] joined crackjack.tailnet via Headscale
[dns  ] workers resolved through MagicDNS
[db   ] SurrealDB job job_7f31 loaded hash_type=SHA-256
[auth ] POST /token/verify -> valid
[worker] node-01 joined  cores=8  arch=aarch64
[worker] node-02 joined  cores=16 arch=x86_64
[http ] accepted request job_id=job_7f31 token=present
[job  ] dispatched chunks=24 workers=2
[hit  ] worker=node-02  plain="hunter2"  Δ=842ms
// live demo

Simulated Brute-Force Cracking

This demo runs entirely in the browser — each worker increments through a text range and reports attempts until the first hit.

attempts
0
status
idle
workers
3
./worker.log — tail -f
no jobs dispatched yet…
// description

Job records, verified requests, one cluster.

The dashboard stores hash data in SurrealDB, then asks the central cracking station to start a job by sending its job id and an identification token. The server verifies that request through the auth provider before distributing work to connected workers.

dashboardNext.js · SurrealDB
  • Creates the cracking job
  • Writes hash data into SurrealDB
  • Calls the server with job_id and token
HTTP request: ?job_id=...
auth providerJava · Gradle
  • Users, Roles, Sessions
  • Identification token checks
  • Request validity decisions
POST /token/verify
cracking stationRust · actix-web
  • Loads the job from SurrealDB
  • Verifies requests through auth
  • Workers join via VPN and MagicDNS
shared network: Tailscale/Headscale + MagicDNS
// stack

Tech Stack

frontend
Next.js 16React 19Tailwind 4
auth
JavaGradleOAuth 2JWT
control plane
Rustactix-webtokioserde
discovery
Tailscale/Headscale VPNMagicDNS
storage
SurrealDB
team
8 StudentsHFU AIN · SoSe 2026HFU ITS · SoSe 2026
// application scenarios

Who uses Cracking Station?

From forensic analysts to academic researchers — anyone who needs distributed hash recovery at scale.

FOR-01
Digital Forensics

Recover access to encrypted evidence files and password-protected archives for law enforcement and investigative teams.

AUD-02
Security Auditing

Validate password policy strength by testing real hashes against modern cracking techniques at cluster scale.

CTF-03
CTF & Research

Solve capture-the-flag challenges at speed. Distribute work across the cluster and get results in seconds, not hours.

REC-04
Password Recovery

Help users regain access to their own encrypted files or accounts — with a full audit trail for every job.

LAB-05
Academic Research

Benchmark hash algorithms, study computational complexity, and publish reproducible cracking experiments.

IR-06
Incident Response

During a breach investigation, quickly identify compromised credentials from leaked hash databases before attackers do.

faq

Frequently asked questions

A quick overview of the project scope, current status, and intended use.

What is CrackJack built for?+

CrackJack is a distributed password-cracking platform designed for demos, research, and educational environments. It shows how cracking jobs are coordinated across multiple workers and how the system can be observed and extended over time.

Is CrackJack ready for production use?+

Not yet. The current version is a student project and technical prototype focused on architecture, experimentation, and transparent system behavior rather than production hardening.

How does distributed cracking work in CrackJack?+

The platform splits the search space into smaller chunks and distributes them across connected workers. A central server coordinates the job, workers process their assigned tasks, and results are returned once a match is found or the search is exhausted.

Which hash types are supported?+

CrackJack currently lists MD5, SHA-1, SHA-256, bcrypt, and Argon2id as implemented hash types.

Who is this project intended for?+

CrackJack is especially suited for university teams, security labs, teaching environments, and technical demos where observability, architecture, and distributed execution are central topics.

How can I contact the team?+

You can find the contact details on the About page, including the project email and institutional information.