When generating your own rainbow table with WinRTGen, what do the parameters Hash, Min/Max Len, Chain Len, Chain Count, and Charset control?
Hash = algorithm, Min/Max Len = password length range, Chain Len/Count = table size vs speed tradeoff, Charset = alphabet to cover.
Each parameter explained:
Hash — Which algorithm the table targets:
ntlmfor Windows hashesmd5,sha1, etc. for other systems- A table built for one algorithm is useless for another
Min Len / Max Len — Password length range to cover:
- e.g. Min 4, Max 6 → covers 4, 5, and 6 character passwords
- Wider range = more storage and compute
Index — Distinguishes one table from another (when generating multiple).
Chain Len — How many hash-reduce steps in a single chain:
- Longer chains = more passwords covered per stored entry
- But also longer crack time per lookup
- Typical: 2,400-10,000
Chain Count — How many chains (= rows) in the table:
- More chains = better coverage = larger file
- Typical: 4,000,000 (4M)
N° of Tables — How many separate table files (parallel coverage).
Charset — Alphabet to cover:
loweralpha=a-z(26 chars) — fast, narrowloweralpha-numeric=a-z0-9(36 chars)mixalpha-numeric=a-zA-Z0-9(62 chars)all-space= full printable ASCII — slow, broad
The fundamental tradeoff:
Storage = chain_count × 16 bytes (typical entry size)
Crack speed ≈ chain_len × hash_compute_time per lookup
Coverage probability ≈ 1 - exp(-chain_len × chain_count / keyspace)
Realistic example:
- NTLM, lengths 4-6, lowercase only
- Chain Len 2,400 / Chain Count 4,000,000
- Result: ~600 MB table covering most short lowercase passwords with ~99% probability
Tip: Pre-built tables exist for most common configurations — generate your own only when you need an unusual charset or hash. Free tables: https://www.freerainbowtables.com/.