What a rainbow table is
A rainbow table is a precomputed table used to crack password hashes quickly. When services store passwords, they usually keep a hash, a scrambled fingerprint produced by a one-way function, rather than the password itself. A rainbow table contains huge numbers of precomputed hashes and the passwords that produce them, so an attacker who steals a hash can look it up instead of computing guesses from scratch.
The problem it solves for attackers
Cracking a hash by brute force means hashing one guess at a time and comparing it, which is slow when repeated across millions of accounts. Precomputing every hash in advance and storing it would be faster to search but would need an impossible amount of storage. Rainbow tables are a clever middle ground, a time-memory trade-off that uses far less storage than a full table while still being much faster than live guessing.
How the trade-off works
Instead of storing every password and hash, a rainbow table stores only the start and end of long chains of alternating hashing and reduction steps. To crack a hash, the attacker regenerates chains until the target falls into one, then walks that chain to find the original password. This reconstructs answers on demand from compact data, which is why the structure saves so much space compared with a complete lookup table.
Why salting defeats it
The defense against rainbow tables is salting. A salt is a unique random value added to each password before it is hashed, so two people with the same password end up with completely different hashes. Because a rainbow table is built for unsalted hashes, a unique salt per user makes any precomputed table useless: the attacker would need a separate table for every possible salt, which is completely impractical.
Why they matter less today
Rainbow tables were a serious threat when systems used fast, unsalted hashes like plain MD5 or SHA-1. Modern practice has largely neutralized them by always salting passwords and using slow, purpose-built hashing functions such as bcrypt, scrypt, and Argon2, which are deliberately expensive to compute. Rainbow tables remain a useful lesson, though, in why those two measures, salting and slow hashing, became standard.
The bottom line
A rainbow table speeds up password cracking by precomputing hash chains, trading memory for time to reverse unsalted hashes far faster than brute force. Its weakness is simple: adding a unique salt to every password makes precomputed tables worthless. The rise and fall of rainbow tables is exactly why salting and slow hashing are now considered the baseline for storing passwords safely.
Related on Skillo
See also: What is hashing? Explained, What is salting passwords? Explained.
Sources
Published date reflects the original event date (2026-10-23). This article is original Skillo editorial written from the sources above; facts were verified in September 2026.
Leave a Reply