HackDev-PassAudit

Offline password strength auditor, hash-type identifier, and dictionary-based hash cracker. Part of the HackDev cybersecurity toolkit. Everything runs locally — the tool never makes a network request and never touches a live login form or third-party service.

Features

• check — zxcvbn-inspired scoring: Shannon entropy, length, character-class diversity, an embedded list of ~200 common weak passwords, l33t-speak detection (flags P4ssw0rd as a variant of password), date/year pattern detection, keyboard-walk and repeated-run/sequential detection, and flags the extremely common Word123! shape. Reports a verdict from very-weak to very-strong plus a realistic crack-time estimate at two assumed guess rates (10¹⁰/sec for a fast unsalted hash, 10⁴/sec for a slow salted hash).
• identify — regex/length-based identification covering MD5, SHA1, SHA256, SHA512, SHA3-256, SHA3-512, bcrypt, Argon2id/Argon2i, scrypt, and Django's pbkdf2_sha256$ format, with explicit ambiguity notes and embedded cost/iteration-parameter extraction where the format exposes them (bcrypt cost factor, Argon2 memory/time/parallelism, Django iteration count).
• crack — streams a wordlist line-by-line (never loaded fully into memory), with:
  • a rule-based mutation engine (--rules basic|aggressive|none): capitalization, common digit suffixes, l33t-speak substitution, common years, and trailing symbols — all lazily generated
  • multi-hash mode (--hash-file hashes.txt): cracks many hashes in a single pass through the wordlist, checking every candidate against all not-yet-cracked hashes at once, instead of re-scanning the wordlist once per hash
  • --algo auto-detection from hash length, --resume via a checkpoint file
• Structured --format json output on every subcommand.
• All status/error messages go through the logging module.

Install

Requires Python 3.10+. No third-party dependencies.

git clone https://github.com/raghubirrajmahato15/HackDev-PassAudit.git
cd HackDev-PassAudit

Usage examples

Check a password's strength (now flags l33t-speak, dates, and the "Word123!" shape):

python passaudit.py check "P4ssw0rd2023!" --format json

Identify a hash, including cost parameters:

python passaudit.py identify '$argon2id$v=19$m=65536,t=3,p=4$c29tZXNhbHQ$RdescudvJCsgt3ub'

Crack a single hash with an aggressive mutation ruleset (l33t/years/symbols on top of the wordlist):

python passaudit.py crack 4ca7c5c27c2314eecc71f67501abb724 \
  --wordlist ./wordlists/rockyou-sample.txt --algo md5 --rules aggressive --threads 8

Crack many hashes from a leaked database dump in one pass:

python passaudit.py crack --hash-file dump_hashes.txt \
  --wordlist ./wordlists/rockyou-sample.txt --algo sha256 --format json

Resume a previously interrupted crack:

python passaudit.py crack 4ca7c5c27c2314eecc71f67501abb724 \
  --wordlist ./wordlists/rockyou-sample.txt --algo md5 --resume

CLI flag reference

Flag	Subcommands	Description
password (positional)	check	Password string to evaluate
hash (positional)	identify, crack	Hash value to identify/crack (omit for crack if using --hash-file)
--hash-file PATH	crack	File of target hashes, cracked in a single wordlist pass
--wordlist PATH	crack	Path to a local wordlist file (required)
--algo {md5,sha1,sha256,sha512,sha3_256,sha3_512}	crack	Hash algorithm; auto-detected from hash length if omitted
--rules {none,basic,aggressive}	crack	Mutation rule set applied to each wordlist entry (default: none)
--threads N	crack	Number of worker threads (default: 4)
--resume	crack	Resume from the last checkpointed line offset
--checkpoint PATH	crack	Checkpoint file path (default: <wordlist>.passaudit.checkpoint)
-o, --output PATH	all	Also write results to this file
--format {text,json}	all	Output format (default: text)
-v, --verbose	all	Enable verbose (debug-level) logging

Project layout

passaudit.py              Thin CLI entrypoint
hackdev_passaudit/
  strength.py               check subcommand: scoring, l33t/date/keyboard-walk detection
  identify.py                identify subcommand: hash-type patterns + cost-param extraction
  mutate.py                   Rule-based mutation engine (lazy generators)
  crack.py                     Streaming single- and multi-hash cracking
  cli.py                        argparse wiring, output formatting
tests/                     pytest suite

Testing

pip install -r requirements-dev.txt
pytest -q

Covers strength scoring against known weak/medium/strong passwords, l33t/date/keyboard-walk detectors on crafted examples, hash identification against real sample hashes of every supported type (computed with hashlib in the tests), mutation-engine output for each rule set, and multi-hash cracking correctness against a real temp wordlist file (not mocked).

Legal

HackDev-PassAudit is a defensive, offline auditing tool. It is intended for checking the strength of your own passwords and identifying/cracking your own locally-held hash values. It performs no network requests and cannot be used to attack live accounts or services. Never use this tool against accounts, systems, or hashes you do not own or do not have explicit written permission to test. The mutation engine in particular is for auditing your own credentials only — not for guessing at other people's passwords. You are solely responsible for complying with all applicable laws and regulations.