In-browser hash cracker with rule transforms

Cracking is guess-and-compare: hash every candidate, look for the target digest. The interesting part is never the hashing, it is the candidate generation - a plain wordlist finds password, but the passwords challenges actually use are P@ssw0rd!, password123, and drowssap.

Rules multiply a wordlist

• Case toggling - password, Password, PASSWORD.
• Leetspeak - a to 4, e to 3, o to 0, s to 5, applied in every combination.
• Reversal - a surprisingly common CTF twist.
• Digit append - word0 through word plus N digits, which covers the year-and-exclamation-mark family.

A 10,000-word list under case, leet, and two appended digits is several million candidates - well within what a browser handles in seconds for a fast hash like MD5, and completely impractical for bcrypt at cost 12. That gap is why identifying the hash comes first: it tells you whether cracking is the intended path at all.