A cybersecurity web application built as a student portfolio project by Tia D. Demonstrates practical understanding of password security, cryptographic hashing, and dictionary-based hash cracking.
- Real-time strength scoring (0–100) with a visual meter
- Entropy calculation in bits
- Estimated GPU-based crack time
- Character class checklist — uppercase, lowercase, numbers, symbols
- Common password detection
- Actionable tips to improve weak passwords
- Paste any hex hash to auto-detect its algorithm (MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512)
- Automatically attempts to crack the hash via dictionary attack
- Hashes generated in the same session are always reversible — even if the word isn't in the wordlist
- Built-in hash generator (MD5, SHA-1, SHA-256, SHA-512) — generate a hash then click it to reverse it instantly
Hashing is a one-way function — you cannot mathematically reverse a hash back to its original input. This is what makes hashing secure for storing passwords.
The cracker uses two methods:
-
Session memory — when you generate a hash using the built-in generator, the app remembers the original word in memory. If you then paste that hash into the identifier, it can reverse it instantly because it already knows what went in.
-
Dictionary attack — for unknown hashes, the app hashes every word in a wordlist and compares the result to the target hash. If it finds a match, the original word is revealed. This only works if the password is weak/common enough to be in the list.
This is exactly how real-world hash cracking tools like Hashcat and John the Ripper work.
| Layer | Technology |
|---|---|
| Backend | Python 3.10+, Flask |
| Frontend | HTML5, CSS3, Vanilla JavaScript |
| Hashing | Python hashlib, Web Crypto API |
- Python 3.10+
- pip
# Clone the repo
git clone https://github.com/hexL3t/security-toolkit.git
cd security-toolkit
# Install dependencies
pip install -r requirements.txt
# Run the app
python app.pyThen open http://localhost:5000 in your browser.
security-toolkit/
├── app.py # Flask backend & API routes
├── requirements.txt # Python dependencies
├── LICENSE
├── README.md
├── wordlists/
│ └── common.txt # Dictionary wordlist for hash cracking
├── templates/
│ └── index.html # Main HTML template
└── static/
├── css/
│ └── style.css # Dark theme stylesheet
└── js/
└── main.js # Frontend logic
| Method | Endpoint | Description |
|---|---|---|
| POST | /api/password |
Analyse password strength |
| POST | /api/hash/identify |
Identify hash algorithm |
| POST | /api/hash/crack |
Attempt wordlist crack |
- How password entropy is calculated and why length matters more than complexity
- Why hashing is one-way and how dictionary attacks exploit weak passwords
- How to build a REST API with Flask and connect it to a vanilla JS frontend
- Practical use of the Web Crypto API for client-side hashing
This project is built for educational purposes only as part of a personal learning journey in cybersecurity. Only test on systems and data you own. Never use these tools against systems without explicit permission.
MIT © 2026 Tia Darvell