Rainbow Table Attacks - Cracking Hashed Passwords

About 2 min read

A rainbow table is a precomputed table used to reverse-look-up the original password from a hash value. By creating a correspondence table between a large number of passwords and their hash values in advance, the original password can be quickly identified by matching it against a leaked hash value. It is an efficient attack method that exploits a time-space trade-off, and as of 2025 it remains a viable threat against systems that use fast hashes such as MD5 or SHA-1.

The Storage Scheme Determines the Damage After a Breach

A leak of hash values does not itself contain plaintext passwords. However, if the passwords were stored with a fast hash function and without a salt, matching against a precomputed table alone turns many of the hashes back into plaintext in a short time. Even when the fact of the leak is the same, the scale of the resulting damage has already been determined by the choice of storage scheme. Moreover, correcting the storage scheme after a leak has no effect on the hash values that have already left the organization. Hashes can be regenerated only in the database that remains in one's own hands; the copy in the attacker's hands stays in the old scheme. The password storage scheme is therefore the layer that sets the upper bound on damage when intrusion cannot be prevented, and it is the part that cannot be compensated for by after-the-fact response. In this respect its role differs from that of mechanisms which act after the fact, such as intrusion detection or disclosure procedures.

How Rainbow Tables Work

How Rainbow Tables Work and Numerical Examples

A rainbow table stores chains created by alternately applying a reduction function and a hash function. An MD5 rainbow table for an 8-character password of lowercase letters and digits (about 2.8 trillion combinations) can be built at around 460 GB, and cracking completes within minutes. On the other hand, for a 12-character password of upper- and lowercase letters, digits, and symbols, the table size balloons to hundreds of petabytes, making it virtually impossible to build. In other words, simply increasing the length and character variety of a password dramatically reduces the effectiveness of a rainbow table attack.

Countermeasures Against Rainbow Tables

The most effective countermeasure is to add a salt (random data) to the password before hashing it. When a salt is added, even identical passwords generate different hash values for each user, which renders precomputed tables useless. In modern password storage, hash algorithms such as bcrypt and Argon2, which automatically add a salt and allow the computational cost to be adjusted, are the standard. Service developers must not use fast hashes such as MD5 or SHA-1 for storing passwords.

User-Side Defenses

A random password of 16 or more characters has an astronomically low probability of being included in a rainbow table, giving it high resistance to this attack. Increasing the entropy of a password is the best defense against any offline attack.