CrackStation's Terms of Service and Privacy Policy

Terms of Service

CrackStation's main goal is to promote the use of properly implemented salted hashing in new and existing web applications. We provide this service to help security researchers demonstrate the importance of hash salting. Any users that choose to use CrackStation as a malicious tool are solely responsible for their own actions; malicious use is not permitted.

Privacy Policy

CrackStation respects the privacy of its users. We DO NOT log the hashes that you crack, or the plaintexts we recover for you. They exist only for as long as it takes to answer your request. We do not sell information about you, we set no cookies of our own, and we give your browser no identifier of our own.

What we keep

Your IP address and web browser information may be logged as you request web pages from this site. In addition, the footer of every page shows a hit counter, and so that the "Unique Hits" number does not count the same visitor twice, we store a one-way value derived from the page name and your IP address, along with the time of your visit. That record is deleted 30 days after your first visit to that page.

That value is computed with a random secret key that the server creates when it starts and holds only in memory. The key is never written to disk, is gone the moment the server restarts, and is replaced with a fresh one every 60 days. A copy of that database on its own therefore cannot be checked against your IP address: the stored value cannot be recomputed without the key, and the key does not outlive the running server. Anyone able to read the memory of the server while it is running could still make that connection, so this protects the records once they leave the machine rather than making them anonymous everywhere.

The hit counts themselves are plain totals with nothing in them that points back to any visitor, and we keep those indefinitely.

Who else sees your IP address

This site uses Google reCAPTCHA to stop automated clients from consuming the service, so Google sees your IP address by two routes. The home page loads a script from Google, which means that when you open it your browser contacts Google directly and Google receives your IP address, your browser information and the page you came from; Google may also store data in your browser at that point. Then, when you submit hashes, our server sends your IP address to Google together with your answer to the captcha. What Google does with any of that is governed by Google's privacy policy rather than by this one. No other page on this site loads anything from a third party.

A caution

You should still not try to crack the hash of your own password or other sensitive information. Your connection might be being intercepted; the page that shows your results is also the page that runs Google's script; and simply loading a page here creates the visit record described above.