At a glance
A rainbow table attack works by matching a stolen password hash against a pre-built lookup table of known hash-to-password pairs. It collapses entirely once the password has been stored with a salt, which is now standard practice.
Salting inserts a random value into each password before it is hashed. Because every password receives its own unique random addition, two identical passwords produce completely different stored hashes.
This single change is the main reason the attack moved from serious threat to largely obsolete. For complete account protection, the Mailfence suite combines encryption with strong security defaults from the moment you create your inbox.
“Rainbow table attack” appears on almost every list of password-cracking methods. The name sounds formidable, and for a long time it was.
What changed? A simple defence known as salting removed most of its effectiveness. The technique has not disappeared completely, however. It can still succeed against outdated systems and reused passwords.
The more useful question is not whether the name sounds alarming. It is whether any system you depend on remains exposed and what steps you can take to close that exposure.
What is a rainbow table attack?
A rainbow table attack recovers passwords by comparing stolen hashes against a large, pre-computed table that maps hashes back to their original plaintext. The attacker bypasses live guessing and performs a direct lookup instead.
Any competent service stores your password as a hash—a fixed-length fingerprint produced by a one-way function. The original password itself is never retained.
The vulnerability arises because identical passwords always generate identical hashes. A rainbow table exploits precisely this consistency, turning one prepared file into a tool capable of cracking thousands of stolen hashes in a single operation.
That efficiency made rainbow table attacks the preferred shortcut for breaking large collections of leaked passwords.
Why is it called a rainbow table?
The name describes what occurs inside the table rather than any visual appearance. Every table is constructed from calculation chains. Each chain alternates between two operations: a hash function that turns a password into a fixed character string, and a reduction function.
A reduction function converts a hash into a new candidate password. It does not reverse the hash or decrypt anything. It simply produces the next link in the chain.
Repeating that alternation dozens of times allows one chain to cover a vast set of candidate passwords without storing each one separately. Only the starting and ending values of each chain are retained, which reduces storage requirements dramatically.
In the most sophisticated versions, the reduction function itself changes at every step. That variation prevents separate chains from colliding and is the origin of the colourful name.
How does a rainbow table password attack work?
Five steps summarise how a rainbow table password attack unfolds.
- Obtain the hashes. The attacker acquires password hashes, usually through a software vulnerability, a compromised database, or malicious code.
- Match the algorithm. They select or generate a rainbow table constructed for the exact hashing algorithm used by the target system.
- Process the hashes through the chains. Each stolen hash is run through the same reduction sequence that built the table.
- Recover the match. When a hash lands on a known chain endpoint, the attacker replays that chain from the beginning and extracts the original password.
- Reuse the password elsewhere. They test it first on the breached account, then on other services, because reused passwords are where the real damage occurs.
Rainbow table vs dictionary attack vs brute force
A rainbow table attack belongs to a wider family of password-cracking techniques that also includes credential stuffing and password spraying.
💡 In plain terms: password spraying takes one commonly used password and tries it across a large number of accounts, rather than testing many passwords against a single account.
What distinguishes these methods is timing: some perform all their computation in real time, while others rely on preparation completed long before the attack starts. Brute force systematically tests every possible character combination until it finds the correct password.
| Criterion | Rainbow table | Brute force | Dictionary |
| Core resource | Pre-built lookup table | Raw computing power (CPU/GPU) | Wordlists of common passwords |
| Preparation | Heavy | None | Light |
| Speed during the attack | Very fast (a direct lookup) | Slow | Fast against common patterns |
| Works against salted hashes | No | Yes | Yes |
That final row tells the complete story. As soon as salting is applied, the entire pre-built table becomes useless.
Are rainbow table attacks still a threat?
Against modern systems, almost never. Against older ones, definitely.
Unsalted formats such as NTLM and LM continue to exist in legacy infrastructure. Many connected devices also ship with weak default passwords. Both remain straightforward targets for this type of attack.
The 2012 LinkedIn breach is a classic illustration. Passwords were hashed with SHA-1 and no salt, exposing roughly 6.5 million hashes. A substantial portion of them was cracked within days.
Four years later the full extent became clear: around 117 million accounts had been affected by the same 2012 theft.
Stolen credentials remain one of the most reliable entry points for attackers. Verizon’s Data Breach Investigations Report has associated them with roughly a third of all breaches over the past decade, and password reuse is what converts one cracked hash into access to many accounts.
What is the best defence against rainbow table attacks?
Salting is the single most effective countermeasure. Without salting, a rainbow table functions exactly as intended.
Modern hash functions such as bcrypt or Argon2 introduce an additional obstacle.
💡 In plain terms: these functions are deliberately designed to run slowly, making automated cracking far more costly in time even when no precomputed table is used.
A long, unique password for every account is equally essential. Sound password habits prevent a single breach from spreading across your other services.
Two-factor authentication supplies one further layer of protection, blocking access even if a password is recovered.
How Mailfence protects your account from password attacks
Mailfence hashes every stored password with modern, salted algorithms, so a rainbow table has nothing usable to match against.
Two-factor authentication is included by default, providing an extra verification step each time you sign in.
A range of account security settings allows you to strengthen your defences further on a daily basis.
“The best defence against yesterday’s attacks is rarely dramatic, it’s discipline. We handle the hard part on our side, storing every password with modern salted hashing, and we give people simple tools like two-factor authentication to close the gap on theirs.” – Patrick De Schutter, Co-founder of Mailfence
Key takeaways
- A rainbow table recovers passwords by looking up their hashes in a pre-built table, avoiding any real-time computation.
- Salting defeats this method completely, which is the main reason the attack has declined.
- Legacy systems, unsalted hashes, and poorly secured connected devices remain vulnerable.
- A strong, unique password combined with two-factor authentication removes this risk at the account level.
Final thoughts on rainbow table attacks
The rainbow table attack was once regarded as one of the most dangerous password-cracking techniques available. Salting and modern hash functions have removed most of its power, so it now persists mainly in outdated or misconfigured environments.
A strong, unique password together with two-factor authentication remains your most dependable line of defence.
Get the latest privacy news in your inbox
Sign up to the Mailfence Newsletter.
FAQ about rainbow table attacks
How do attackers figure out which hashing algorithm was used?
Hash outputs follow recognizable patterns in length and format. MD5, SHA-1, and NTLM each produce a distinct signature. Once the algorithm is identified, the attacker grabs the corresponding rainbow table.
Can rainbow tables break long or complex passwords?
In practice, no. The size of the table balloons exponentially as password length and character variety increase. Attackers concentrate on short, predictable passwords because long, random ones sit far outside any table's realistic coverage.
Do rainbow tables work against modern algorithms like SHA-256?
Only when there is no salt, and even then it is barely practical. SHA-256 produces such a vast number of possible outputs that building a complete table for it is not feasible. Salted SHA-256 storage is effectively immune.
Are rainbow tables faster than GPU brute force?
When the hash is unsalted and the algorithm is fast, yes. In most real-world conditions today, GPU brute force outpaces them. That said, a pre-built table still delivers instant results for common passwords.
Does 2FA block a rainbow table attack?
It doesn't prevent the hash from being cracked, but it prevents the attacker from using the result. The second verification step locks them out even with the correct password in hand, which is why Mailfence makes it easy to turn on.
Can you detect a rainbow table attack?
Typically not while it's happening. The cracking runs offline, with no connection to your systems. You can only spot it once the attacker tries the recovered passwords against live accounts.
