What is a rainbow table attack?
Definition
A rainbow table attack cracks stolen password hashes by looking them up in a huge table of precomputed hashes, instead of guessing passwords one by one. Salting defeats it.
- Category
- Attacks
- Also called
- rainbow table
- Last updated
When you create a password, a well-run site doesn't store it. It stores a scrambled version called a hash. If attackers steal that list of hashes in a breach, they still need to work out the original passwords.
A rainbow table speeds that up. NIST's technical guide to security testing (SP 800-115) describes rainbow tables as lookup tables with precomputed password hashes. The attacker compares each stolen hash against the table, and a match reveals the password without computing guesses at that moment. It's a trade: lots of storage and prep work in advance for fast lookups later.
Why salting stops it
The same NIST guide notes that rainbow tables don't give correct results unless they take salting into account, and that accounting for salt greatly increases the storage they need. A salt is a random value added to each password before hashing, so two people with the same password end up with different hashes. A table built for unsalted hashes is useless against them.
Rainbow table vs. similar attacks
- Dictionary attack: the attacker hashes a word list live and compares. See dictionary attack.
- Brute force: tries every possible combination. See brute force attack.
- Credential stuffing: uses passwords already leaked in plain text, no cracking needed. See credential stuffing.
What it means for you
You don't control how a site stores your password, but you control what's in it. A long, unique password that isn't a common word is far less likely to be sitting in someone's table, and if one site is breached, a unique password protects your other accounts.
How to protect yourself
- 1
Use long, random passwords
Common words and patterns are exactly what precomputed tables cover. A password manager can generate and store random ones.
- 2
Never reuse a password
If a site's hashes are cracked, a unique password keeps the damage to that one account.
- 3
Turn on two-step verification
Even a cracked password isn't enough to sign in if a second factor is required.
- 4
Change passwords after a breach notice
If a company tells you it was breached, change that password and any account that shared it.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
Does salting stop rainbow table attacks?
Yes. NIST notes rainbow tables don't produce correct results without accounting for salt, and doing so greatly increases the storage they need, which makes them impractical.
Can someone use a rainbow table on my accounts directly?
No. It only works on stolen hash lists, after a site has been breached. That's why unique passwords matter.
Is a rainbow table the same as a dictionary attack?
No. A rainbow table is precomputed in advance and just looked up. A dictionary attack hashes guesses from a word list at attack time.
Sources
Something wrong or out of date? Tell us and we'll re-check it.