ibnaleem Weakpass
Query Weakpass against ~25 billion leaked passwords. No API key.
Search returns the plaintext if the hash is known. Range returns hash:pass pairs for a hex prefix. Generate applies hashcat rules to a seed word. Wordlists lists (and can fetch) hosted dictionaries.
Canonical caller: skills/weakpass/scripts/lookup.sh.
Route
| Input | Action |
|---|---|
32–64 hex chars [A-Fa-f0-9] |
search — type is auto-detected |
| 6–31 hex chars, or an explicit prefix/range ask | range |
| Seed word + rules / "mutate this" | generate |
| Need rockyou / ignis / a named list | wordlists — list first, never dump rockyou.txt into context |
| Email, username, phone, domain | Stop. Use leakcheck. |
| 24-char truncated SHA-256 | LeakCheck email hash, not Weakpass (search minimum is 32) |
Typical lengths: MD5/NTLM 32, SHA-1 40, SHA-256 64.
Search
GET https://weakpass.com/api/v1/search/{hash}.json
skills/weakpass/scripts/lookup.sh search "$HASH"
200:
{ "type": "md5", "hash": "12345678902dd833fc9db9d72e9483c5", "pass": "4kgdjv1" }
.txt is type;hash;pass if a caller needs it. Prefer JSON.
404 — hash not in the database. Say so; do not invent a password.
Range
GET https://weakpass.com/api/v1/range/{prefix}.json
GET https://weakpass.com/api/v1/range/{prefix}.json?type=sha1&filter=pass
skills/weakpass/scripts/lookup.sh range "$PREFIX" [type] [filter]
Prefix: 6–64 hex. Optional type: md5 (default), ntlm, sha1, sha256. Optional filter: hash or pass.
200 is an array of { "hash", "pass" } (or only the filtered key). Prefix f2df2a returned 1565 rows — count, show a short sample, do not paste the whole list.
Precomputed lists: md5/ntlm → all_in_one; sha1/sha256 → weakpass_4a.
Generate
GET https://weakpass.com/api/v1/generate/{word}?set=online.rule&type=json
skills/weakpass/scripts/lookup.sh generate "$WORD" [set]
Always send Accept: text/plain — even when type=json. Default set is online.rule.
| set |
|---|
online.rule |
top_3000.rule top_1500.rule top_750.rule top_500.rule top_250.rule |
nsa64.rule |
numbers.rule numbers100.rule |
years_1900_2025.rule years.rule |
symbols.rule |
URL-encode {word}. JSON body is a string array; txt is one candidate per line.
POST /generate/custom/{string} and /generate/file exist for user-supplied hashcat rules. Do not upload rules unless the user provided them.
Wordlists
GET https://weakpass.com/api/v1/wordlists
GET https://weakpass.com/api/v1/wordlists/{name}
skills/weakpass/scripts/lookup.sh wordlists
Known names: 10_million_password_list_top_10000.txt, hashmob.net.small.found.txt, ignis-10K.txt, nsa64.rule, rockyou.txt.
rockyou.txt and other full dictionaries are too large for chat. If the user wants the file, write it to disk; do not inline it.
Errors
| Status | Meaning |
|---|---|
| 200 | Hit (search object, range array, generate list) |
| 404 | Not in DB / unknown wordlist |
| 500 | Invalid hex, invalid charset, or general error |
Validate hex before calling. Do not retry 404. Surface HTTP status plus body.
Report
Quote API fields. Mark anything inferred.
# Weakpass: {hash|prefix|word}
- Action: search | range | generate | wordlists
- Type: md5 | ntlm | sha1 | sha256 | (auto)
- Result: found `{pass}` | not found | {n} range rows | {n} candidates
## Sample
- …
Treat recovered passwords as sensitive. Put them in the report the user asked for; do not write them into logs, tickets, or world-readable files. Do not attempt logins with cracked credentials.
Docs: https://weakpass.com/api — OpenAPI https://weakpass.com/openapi.json