# Weakpass

> Crack or look up password hashes and generate hashcat-mutated wordlists via Weakpass (25B leaked passwords, no API key). Trigger whenever an MD5, NTLM, SHA-1, or SHA-256 password hash, a hex hash prefix, a cracked password, a wordlist, or hashcat rules appear in the task — hash search, range lookup, password cracking, weak-password check, or wordlist generation — even if Weakpass is not named. Do not use for emails, usernames, or phones (that is leakcheck).

- Skill: `ibnaleem/weakpass` (Agent Skill, multi-file: 4 files)
- Install (CLI): `npx skillmds@latest add ibnaleem/weakpass`
- Raw SKILL.md: https://api.skillmd.com/api/skills/ibnaleem/weakpass/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Integrations & APIs
- License: GPL-3.0
- Author: ibnaleem (https://skillmd.com/u/ibnaleem)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/ibnaleem/weakpass

---


# Weakpass

Query [Weakpass](https://weakpass.com/api) against ~25 billion leaked passwords. No API key.

Search returns the plaintext if the hash is known. Range returns hash:pass pairs for a hex prefix. Generate applies hashcat rules to a seed word. Wordlists lists (and can fetch) hosted dictionaries.

Canonical caller: `skills/weakpass/scripts/lookup.sh`.

## Route

| Input | Action |
| --- | --- |
| 32–64 hex chars `[A-Fa-f0-9]` | `search` — type is auto-detected |
| 6–31 hex chars, or an explicit prefix/range ask | `range` |
| Seed word + rules / "mutate this" | `generate` |
| Need rockyou / ignis / a named list | `wordlists` — **list first**, never dump `rockyou.txt` into context |
| Email, username, phone, domain | Stop. Use `leakcheck`. |
| 24-char truncated SHA-256 | LeakCheck email hash, not Weakpass (search minimum is 32) |

Typical lengths: MD5/NTLM 32, SHA-1 40, SHA-256 64.

## Search

```text
GET https://weakpass.com/api/v1/search/{hash}.json
```

```bash
skills/weakpass/scripts/lookup.sh search "$HASH"
```

200:

```json
{ "type": "md5", "hash": "12345678902dd833fc9db9d72e9483c5", "pass": "4kgdjv1" }
```

`.txt` is `type;hash;pass` if a caller needs it. Prefer JSON.

404 — hash not in the database. Say so; do not invent a password.

## Range

```text
GET https://weakpass.com/api/v1/range/{prefix}.json
GET https://weakpass.com/api/v1/range/{prefix}.json?type=sha1&filter=pass
```

```bash
skills/weakpass/scripts/lookup.sh range "$PREFIX" [type] [filter]
```

Prefix: 6–64 hex. Optional `type`: `md5` (default), `ntlm`, `sha1`, `sha256`. Optional `filter`: `hash` or `pass`.

200 is an array of `{ "hash", "pass" }` (or only the filtered key). Prefix `f2df2a` returned **1565** rows — count, show a short sample, do not paste the whole list.

Precomputed lists: md5/ntlm → `all_in_one`; sha1/sha256 → `weakpass_4a`.

## Generate

```text
GET https://weakpass.com/api/v1/generate/{word}?set=online.rule&type=json
```

```bash
skills/weakpass/scripts/lookup.sh generate "$WORD" [set]
```

Always send `Accept: text/plain` — even when `type=json`. Default set is `online.rule`.

| set |
| --- |
| `online.rule` |
| `top_3000.rule` `top_1500.rule` `top_750.rule` `top_500.rule` `top_250.rule` |
| `nsa64.rule` |
| `numbers.rule` `numbers100.rule` |
| `years_1900_2025.rule` `years.rule` |
| `symbols.rule` |

URL-encode `{word}`. JSON body is a string array; `txt` is one candidate per line.

POST `/generate/custom/{string}` and `/generate/file` exist for **user-supplied** hashcat rules. Do not upload rules unless the user provided them.

## Wordlists

```text
GET https://weakpass.com/api/v1/wordlists
GET https://weakpass.com/api/v1/wordlists/{name}
```

```bash
skills/weakpass/scripts/lookup.sh wordlists
```

Known names: `10_million_password_list_top_10000.txt`, `hashmob.net.small.found.txt`, `ignis-10K.txt`, `nsa64.rule`, `rockyou.txt`.

`rockyou.txt` and other full dictionaries are too large for chat. If the user wants the file, write it to disk; do not inline it.

## Errors

| Status | Meaning |
| --- | --- |
| 200 | Hit (search object, range array, generate list) |
| 404 | Not in DB / unknown wordlist |
| 500 | Invalid hex, invalid charset, or general error |

Validate hex **before** calling. Do not retry 404. Surface HTTP status plus body.

## Report

Quote API fields. Mark anything inferred.

```markdown
# Weakpass: {hash|prefix|word}
- Action: search | range | generate | wordlists
- Type: md5 | ntlm | sha1 | sha256 | (auto)
- Result: found `{pass}` | not found | {n} range rows | {n} candidates

## Sample
- …
```

Treat recovered passwords as sensitive. Put them in the report the user asked for; do not write them into logs, tickets, or world-readable files. Do not attempt logins with cracked credentials.

Docs: https://weakpass.com/api — OpenAPI https://weakpass.com/openapi.json