Password audits
We test your organisation's passwords the way an attacker would after a hash leak — and show which policies work and which exist only on paper.
Scope
- Cracking Active Directory hashes
- Shared and reused passwords
- Presence in public breaches
- Compliance with the password policy
- Privileged and service accounts
What you get
- Statistics without revealing passwords
- List of accounts that need a change
- Password policy recommendations
- Material for staff training
What a password audit is
A comprehensive assessment of credential security in your organisation. We focus on the weak points of passwords: low complexity, reuse and presence in breach databases. It is an essential service for organisations managing large numbers of accounts, where both efficiency and security matter.
Our own hardware, full confidentiality
We run audits with our own tooling and dedicated cracking rigs built on Nvidia RTX graphics cards. Dedicated hardware gives performance, cost efficiency and full confidentiality — no cloud involved. We work on hashes, not plaintext, and the report contains statistics and account identifiers, never recovered passwords.
What you gain
- Better IT security — identifying weak and compromised passwords removes easy targets for cybercriminals.
- Better access management — we find unused accounts and tidy up access to systems.
- An effective password policy — rules that enforce strong, unique passwords and raise resilience to attacks.
- More aware employees — knowledge about password security changes daily habits.
- Regulatory compliance — readiness for standards and regulations such as NIS2 and GDPR.
- Cost optimisation — fast identification of threats instead of costly incidents.
How to strengthen password protection
- An effective password policy — consistent, secure standards across the company.
- Security level assessment — whether the passwords in use are strong enough and attack-resistant.
- Removing weak points — dictionary, leaked and low-complexity passwords.
- Eliminating reuse — accounts that share the same credentials.
Report and re-audit
The report includes an executive summary, a description of the methodology and attacks performed, and detailed results: patterns found, statistics of cracked passwords and recommendations for the security policy. Regular audits let you measure progress and react to a changing environment.
What our clients say
Working with Unshade guarantees professionalism and the highest standards. The team's flexibility, discretion and commitment were outstanding. I highly recommend Unshade as a reliable partner.
Read on the blog
Introduction to Password Cracking #1 Intro
So you want to be a password cracker, huh? Let us show you how it's done. In this post you will learn how to crack passwords with hashcat dictionary attack.
Introduction to Password Cracking #2 Wordlists
In the previous post, we learned about one of the attack methods that hashcat offers - the dictionary attack. To perform such attack we need dictionary - a good dictionary,
CrackMeIFYouCan 2022 DEFCON Writeup
What's that? CrackMeIfYouCan on DEFCON is one of the most popular hash cracking contests in the wild. Best teams in the world compete on a 48h challenge to crack as many hashes as…
Request an anonymised report
See what our penetration test report looks like: the structure, findings with PoC, CVSS ratings and recommendations. We send an anonymised version to your work email.
- Executive summary
- Findings with proof of exploitation
- CVSS risk ratings
- Step-by-step remediation guidance
The form is being set up. Write to us directly: contact@unshade.pl