Paste an unsalted hash and watch a dictionary attack tear through a wordlist to recover the original password — then see exactly why salting kills this attack dead.
Enter an MD5, SHA-1 or SHA-256 hash (or click a sample). This runs a real dictionary attack against a small built-in wordlist — entirely in your browser.
An unsalted hash is deterministic: md5("password") is always the same string. Attackers precompute hashes for millions of common passwords (a rainbow table) and just look yours up — billions of guesses per second on a GPU. Any password in the list falls instantly.
A salt is random data added before hashing, unique per user. Now the same password hashes differently for everyone, so precomputed tables are useless — each guess must be recomputed per salt.
Use bcrypt, scrypt or Argon2 — they're salted and deliberately slow. See raw digests in the crypto tools.