What a password cracker does

02The loop changes the candidate

Offline means the comparisons are local to the copied verification data rather than login requests to a service. Online attempts interact with that service and may trigger lockouts or rate limits. Neither permission to read a worksheet nor permission to test one account authorizes another target.

For each candidate, compute the teaching rule and compare with the fixed stored value. A matching checksum supports only equality under this weak rule; collisions are easy and the match need not uniquely identify an original input. Stop after the three supplied words.

03Compare the three activity words

The guided stored value is 12. The only permitted candidate words are cat, dog and pen. Their byte arithmetic is printed in the download; do the calculation before comparing it.

Label: teaching checksum. Not MD5, SHA-256, bcrypt, scrypt, Argon2, or PBKDF2.
Rule: add the UTF-8 byte values, then keep the last two decimal digits.
A password recovery tool would call a named verifier. This card uses the checksum so the arithmetic can be checked on paper.

Worked stored value: 09
hi -> 104+105=209 -> 09
no -> 110+111=221 -> 21
ok -> 111+107=218 -> 18
Predicted match: hi

Activity stored value: 12
The three activity words and their predicted digits are on candidates.txt.

Label: three original words for the activity checksum. Not a password list from a breach.

cat -> 99+97+116=312 -> 12
dog -> 100+111+103=314 -> 14
pen -> 112+101+110=323 -> 23

Stored activity value: 12
Predicted match: cat

"""Compare a teaching checksum with three words. Authoring did not run this file.

The checksum is not a password hash. Do not point this file at a real verifier,
a wordlist, or a credential dump. A later run, if separately authorized, may
print only the worked and activity rows in a new directory.
"""


def checksum(word):
    total = sum(word.encode("utf-8"))
    return f"{total % 100:02d}"


def main():
    print("worked stored 09")
    for word in ("hi", "no", "ok"):
        print(word, checksum(word))
    print("activity stored 12")
    for word in ("cat", "dog", "pen"):
        print(word, checksum(word))


if __name__ == "__main__":
    main()

1. Add cat’s byte values 99+97+116. Keep 12 from 312 and compare it with the stored value.
2. Repeat for dog: 100+111+103 leaves 14. For pen: 112+101+110 leaves 23.
3. Write cat as the match within this tiny list, then state the limitation: a two-digit checksum does not identify all possible matching inputs.
4. Stop at three words. Read reference-comparison.py as source if useful; do not run a recovery tool or import a real password list.

04Optional challenge

For about ten optional minutes, draw a loop with candidate → same checksum rule → compare → match/miss. Mark the attempt budget beside the loop. Your drawing should keep the stored value fixed and explicitly stop after the third comparison.

05Fresh cases for the checks

Use these fictional cases for the checks below. They have different inputs from the worked examples. Read them here or make notes; no installation or external service is needed.

Teaching rule: add the given UTF-8 byte values and retain the final two decimal digits, including a leading zero if needed. This is not a password hash.
Candidate 1: ab → 97 + 98.
Candidate 2: ba → 98 + 97.
Candidate 3: ac → 97 + 99.
Stored teaching value: 95. Compare exactly these three words in order and stop, even if more than one matches. No service is named.

A separate weak-checksum worksheet has two different inputs matching its stored value. No original-input provenance or real password-verification method is supplied.

06Explain the evidence and its limit

Optional self-check: draw candidate → same rule → fixed stored-value comparison, with a budget and stop.

Review it: distinguish local comparison from service attempts, keep all matches, call the rule a weak teaching checksum and avoid describing it as decryption or password recovery.