Rainbow Table Attack

What is a rainbow table attack?

A rainbow table attack is a password-cracking method that uses precomputed tables of hash values to recover plaintext passwords from stolen hashes. By matching a stolen hash to one in the table, an attacker recovers the original password without having to guess and hash every possibility.  

How does a rainbow table attack work?

When a password is created, the system usually stores a hash of it rather than the password itself. Hashing converts the password into a fixed-length string that can't be read directly. For example:

• Password:  password123
• Hashed (MD5):  482c811da5d5b4bc6d497ffa98491e38

A rainbow table attack is a precomputed lookup table that maps hash values back to plaintext passwords, using hash chains to cover far more passwords than it stores. When an attacker obtains a hashed password, they search the table for that hash. If there's a match, the original password is recovered. The technique was introduced by Philippe Oechslin in 2003.

Why are rainbow table attacks effective?

Rainbow table attacks work for two reasons:

• Speed. The expensive work, computing hashes, is done in advance. The attack itself is simply a lookup. 
• Scale. A single table can cover billions of candidate passwords, sometimes running to hundreds of gigabytes or terabytes, and be reused against every unsalted hash of the same type.

Rainbow table attack example

An attacker steals a database of hashed passwords. Without a rainbow table, they would have to guess millions of candidate passwords and hash each one to find a match. With a rainbow table, they compare the stolen hash against the table:

• Stolen hash:  482c811da5d5b4bc6d497ffa98491e38
• Rainbow table lookup: Finds that  482c811da5d5b4bc6d497ffa98491e38 corresponds to  password123

How to defend against rainbow table attacks

Three measures make rainbow table attacks ineffective:

• Salt Your Passwords. Adding a unique random value (a salt) to each password before hashing means identical passwords produce different hashes, so a precomputed table can't match them:

  • Password:  password123
  • Salted:  password123+salt
  • Hashed:  a different hash for each salt

• Use slow hash functions. Algorithms such as bcrypt, scrypt and Argon2 are deliberately slow and memory-intensive, which makes building a table impractical. 

• Require multi-factor authentication (MFA). A recovered password alone isn't enough to log in when a second factor is required. 

• Reduce what a cracked password can reach. Privileged credentials held in a vault and rotated automatically limit the damage a recovered password can do, and granting access just-in-time rather than leaving it standing means a cracked credential buys an attacker less. 

Because salting and slow hashing are now standard, rainbow table attacks are far less common than they used to be. But they still work against any system that stores unsalted fast hashes, which is why they remain worth understanding. 

Why rainbow table attacks matter

A stolen password database is only as safe as the way its passwords were hashed. Three consequences follow:

• Breaches. Poorly hashed passwords turn a database leak into a credential leak, with the resulting financial and reputational costs.
• Credential reuse. A password recovered from one breach is tried against other accounts. Reused passwords turn one compromise into several. 
• Compliance. Regulations such as GDPR and PCI DSS require passwords to be stored securely; unsalted or weakly hashed passwords can mean penalties as well as a breach. 

More rainbow table attack resources

Blogs

Password Cracking: How criminals get your company passwords

How do passwords work?