Rainbow Table Attack

Last Updated : 8 Aug, 2026

A Rainbow Table Attack is a password cracking technique that uses precomputed tables of plaintext passwords and their corresponding cryptographic hashes.

  • Attackers obtain a database containing hashed passwords, they compare each hash against the rainbow table to identify the original password without computing every hash during the attack.
  • Rainbow tables trade storage space for computational speed, allowing much faster password recovery when the target uses an unsalted hashing algorithm.
frame_14
Rainbow Table Attack

Rainbow Table Attack Working

The attack follows a structured workflow.

Step 1: Obtain Password Hashes

The attacker gains access to hashed passwords through: Database breaches, Backup leaks, Memory dumps, Misconfigured servers. Example:

User    Hash
Alice   5f4dcc3b5aa765d61d8327deb882cf99
Bob     e10adc3949ba59abbe56e057f20f883e

Step 2: Determine the Hash Algorithm

The attacker identifies the hashing algorithm used, such as: MD5, SHA-1, NTLM, LM. Without knowing the correct algorithm, the rainbow table cannot be used effectively.

Step 3: Search the Rainbow Table

Instead of generating new hashes, the attacker searches the precomputed rainbow table. If a matching hash is found, the corresponding plaintext password is immediately recovered. Example:

Password          MD5 Hash
password          5f4dcc3b5aa765d61d8327deb882cf99
123456               e10adc3949ba59abbe56e057f20f883e
admin                21232f297a57a5a743894a0e4a801fc3

Step 4: Recover Password

Once the hash matches an entry, the original password is revealed without performing additional hash computations.

Rainbow Table Generation Process

Rainbow tables are generated by precomputing password hashes and organizing them into hash chains to reduce storage while enabling fast hash lookups. The chain continues for thousands of iterations before only the first and last values are stored.

  • Select a Character Set: Define the password character set (letters, numbers, symbols) and maximum password length.
  • Generate Passwords: Create plaintext password candidates from the selected character set.
  • Compute Hashes: Hash each password using the target algorithm (e.g., MD5, SHA-1, NTLM).
  • Apply Reduction Function: Convert each hash into a new plaintext password to continue the chain.
  • Build Hash Chains: Repeat the Hash->Reduction cycle for multiple iterations.
  • Store Chain Endpoints: Save only the start and end values of each chain instead of every intermediate password and hash, reducing storage while supporting efficient password recovery.

Reduction Function

A reduction function converts a hash into another possible plaintext password. It is not the reverse of hashing. The reduced password is hashed again to continue building the chain. Example:

Hash(5f4dcc3b5aa765...)->Reduction Function->Pass483

Time-Memory Trade-Off

Rainbow tables use the time-memory trade-off principle, where storage space is used to reduce the time required to crack password hashes. Instead of computing hashes during the attack, attackers perform quick lookups in precomputed tables.

  • Brute Force: High CPU usage, low storage requirement, slow attack speed.
  • Dictionary Attack: Moderate CPU usage, low storage requirement, moderate attack speed.
  • Rainbow Table: Low CPU usage, high storage requirement, very fast attack speed.

Rainbow Table vs. Brute Force

  • Uses Precomputed Data: Rainbow Table(Yes) | Brute Force(No).
  • Storage Requirement: Rainbow Table(Very High) | Brute Force(Low).
  • CPU Usage: Rainbow Table(Low) | Brute Force (High).
  • Attack Speed: Rainbow Table(Fast) | Brute Force(Slow).
  • Effective Against Salted Hashes: Rainbow Table(No) | Brute Force(Yes).
  • Hash Computation During Attack: Rainbow Table(Minimal) | Brute Force(Continuous).

Rainbow Table vs. Dictionary Attack

  • Password Source: Rainbow Table (Precomputed) | Dictionary Attack(Wordlist).
  • Hash Calculation: Rainbow Table(Before Attack) | Dictionary Attack(During Attack).
  • Storage Requirement: Rainbow Table(High) | Dictionary Attack(Low).
  • Attack Speed: Rainbow Table(Faster) | Dictionary Attack(Slower).
  • Scalability: Rainbow Table(Limited by Storage) | Dictionary Attack(Limited by CPU).

Security Best Practices

Organizations can effectively prevent rainbow table attacks by implementing the following controls:

  • Use unique random salts for every password.
  • Store passwords with adaptive hashing algorithms such as bcrypt, scrypt or Argon2.
  • Avoid outdated hashing algorithms like MD5, SHA-1 and LM for password storage.
  • Enforce strong password policies with sufficient length and complexity.
  • Implement multi-factor authentication (MFA).
  • Monitor for credential leaks and require password resets after breaches.
  • Apply rate limiting and account lockout mechanisms to reduce password-guessing attempts.

Limitations

  • Extremely large storage requirements.
  • Different tables are required for each hashing algorithm.
  • Strong passwords increase table size dramatically.
  • Salted hashes invalidate precomputed tables.
  • Memory-intensive for large password spaces.
Comment

Explore