~/projects/krakenhashes
KrakenHashes active
Distributed password cracking for security teams. Agents wrap Hashcat across every GPU and CPU you own, one web interface runs the jobs, and every cracked hash goes into a shared potfile that gets replayed first against the next list.
$ git clone krakenhashesdocsreleasesdiscord
latest release
patch 3.0.1 (2026-11-03) Custom charsets fixed: brute-force (-a 3) mask attacks that reference a custom charset (inline -1 ?l?d, .hcchr charset files, or hex) failed in 3.0.0 with "Custom-charset 1 is undefined". The scheduler-v2 dispatch path dropped the charset definitions on the way to the agent; they are now forwarded on both the speed-test/benchmark and the real run, verified end to end on real hardware (#132).
- Cloud GPU provisioning: when your own agents are saturated, a job can rent GPUs on demand and give them back when it is done. Spend is budgeted per client and reserved up front, instance lifetime is sized to the remaining work, and several independent paths guarantee teardown (including a watchdog inside the instance). AWS EC2 is tested end to end; RunPod and Vast.ai are built but marked experimental. Cloud agents must join over a VPN: there is no public-internet mode (#94, #107).
- Agent auto-update: a new launcher supervises the agent and swaps its binary when the server is upgraded: download, checksum, health-check and automatic rollback, and only while the agent is idle so a running job is never interrupted. Per-user service install on Linux, macOS and Windows (#46).
- Agent mTLS and revoke: agents authenticate with a per-agent certificate on the existing port, migrating automatically with no new port or firewall change. A new Revoke action is the hard kill (invalidates the credential and cuts the connection) (#104).
- Network-share storage: wordlists and rules can live on an NFS/SMB share, with a per-agent storage tier (full cache, on-demand LRU, or direct read-only mount) and a resumable, MD5-checked migration between local and share storage (#83, #101).
- Loopback attacks: re-run a step's rules or hybrid mask against only the newly cracked passwords, round after round, until a round finds nothing new (#64).
- Analytics API, BloodHound enrichment, and PDF export: analytics over the user API, optional in-memory BloodHound AD-privilege enrichment (never written to disk), and internal (full) vs external (server-redacted) PDF reports (#66).
- Rebuilt frontend: one shared table component, light and dark themes, a grouped sidebar, an admin settings hub with autosave, a client detail page, and a dashboard scoped to you or your teams. UI now in 17 languages (up from 7) (#109).
- Custom branding: set the app name, colours, logo and favicon, applied to the login page, PDFs, emails, the TOTP issuer and webhooks. "Powered by KrakenHashes" attribution is enforced server-side (#41).
- Multi-Team hardening: closed a cross-team IDOR on the hashlist download endpoints and added team-access checks to 37 handlers that were missing them (#100, #48).
- Scheduler improvements: automatic slow-hash candidate mode (
-S) keeps the GPU fed on bcrypt/PBKDF2/WPA-style hashes under rules, a chunk-overrun guard stops runaway tasks, and admins can set a default and enforced ceiling for max agents per job (#70, #126).
install
Docker Compose v2 on the server, then enrol agents on the boxes with the GPUs. The quick start walks the whole thing in about ten minutes.
mkdir krakenhashes && cd krakenhashes
wget https://raw.githubusercontent.com/ZerkerEOD/krakenhashes/master/.env.example
cp .env.example .env # set JWT_SECRET, PUID/PGID at minimum
wget https://raw.githubusercontent.com/ZerkerEOD/krakenhashes/master/docker-compose.yml
docker compose up -d
docker compose logs -f krakenhashes # ~30 s, then open https://localhostarchitecture
- Scheduler v2 with adaptive load balancing and chunking across agents.
- REST API with JWT auth, a user API for analytics and automation.
- PostgreSQL for jobs, hashlists, results, audit log and the potfile.
- Cloud GPU provisioning with budgets and guaranteed teardown.
- Hashcat wrapper with checkpointing, benchmarks and self-healing health checks.
- GPU and CPU allocation, device monitoring, scheduling windows.
- Per-agent mTLS with revoke; auto-update only while idle.
- Local, on-demand LRU or network-share storage for wordlists and rules.
- Hash-type detection, job and workflow wizards, live progress.
- Clients, teams, MFA and SSO, branding.
- Analytics, BloodHound enrichment, internal and redacted PDF reports.
- Interface in 17 languages.
KrakenHashes is free and open source under AGPL-3.0, written for professionals with permission to crack the hashes they hold. Nothing here is sold.
documentation
Every release keeps its own docs. latest follows the newest tag, dev follows master.