What Are Rainbow Tables?
Sites do not store your password — they store a scrambled fingerprint of it called a hash. A rainbow table is a gigantic precomputed cheat sheet matching hashes back to passwords, letting attackers reverse weak hashes in seconds without guessing. It is why 'hashed' does not automatically mean 'safe,' and why salting changed everything.
TL;DR / Quick Fix
Quick fix: rainbow tables are precomputed lists that reverse weak password hashes instantly — they work against unsalted hashes of common passwords. You cannot control a site's hashing, but long, random, unique passwords defeat them, and two-factor authentication stops the login anyway.
Follow these steps
- Learn what a hash is. A hash is a one-way scramble of your password — the site stores the scramble, not the password. Logging in re-scrambles what you type and compares. The idea: even a stolen database reveals no passwords.
- Learn what the table does. Attackers precompute hashes for billions of candidate passwords once, then just look stolen hashes up in the table — instant reversal, no guessing. It trades huge upfront computation for instant lookups later.
- Understand why salting kills it. A salt is random data mixed into each password before hashing, making every hash unique. Precomputed tables become useless — the attacker must start over per password. Any modern site salts; ancient breached ones did not.
- See why your password still matters. Salting protects the site's database design, not your weak password. 'Summer2021' hashed with salt is still guessable by dictionary attacks — the table is dead, but guessing is not.
- Use long, random, unique passwords. A 20-character random password is in no table and resists guessing. A password manager makes this effortless — the table cannot contain what was never predictable.
- Add two-factor as the backstop. Even a reversed hash is useless against an account with a second factor. The table gets the password; 2FA still stops the login.
What NOT to do
- Do not assume 'hashed' means 'uncrackable.' Unsalted hashes of common passwords fall to rainbow tables in seconds — the word 'hashed' alone proves nothing.
- Do not reuse passwords across sites. One site's weak hashing exposes the password you used on sites with strong hashing too.
- Do not think this is only the site's problem. Their salting protects their design; your password strength protects you.
- Do not skip two-factor because your password is long. Defense in depth — the table, the guess, and the phish all die at the second factor.
Frequently asked questions
Can rainbow tables crack any hashed password?
No — only unsalted hashes of passwords in the table's precomputed set. Salted hashes and long random passwords are effectively immune.
Why do old breaches still matter?
Ancient breaches used unsalted hashes, so their tables still work on those dumps — and the revealed passwords get reused against your current accounts.
Should I worry about this as a normal user?
Indirectly. You cannot fix sites' hashing, but long unique passwords plus 2FA make you immune to everything tables enable.
What to read next
- Dictionary Attacks Explained
- What Is Credential Stuffing?