hashview Open Source Projects

test_a_live_agents_row_is_left_alone fails on any non-UTC dev machine (SQLite has no NOW(), so the suite only ever runs the UTC fallback) Open

bug

Difficulty 2/5 1-3 hours Newbie friendliness 76/100

hashview/hashview#522 · Opened Sep 16, 2026

API: no way to rename a task group — PATCH /v1/task_groups/<id> is missing Open

enhancement

Difficulty 3/5 1-2 days Newbie friendliness 72/100

hashview/hashview#520 · Opened Sep 16, 2026

Notifications can only be set during job creation — no way to subscribe to an existing job, hash, or account Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 45/100

hashview/hashview#510 · Opened Sep 15, 2026

Manual prune buttons for stranded rule/wordlist entries in Settings → Data management Open

enhancement

Difficulty 4/5 3-5 days Newbie friendliness 58/100

hashview/hashview#502 · Opened Sep 14, 2026

Agent sends hashcat stderr as a Python bytes repr, so admin notifications read b'No hashes loaded.\n\n' Open

bug python

Difficulty 2/5 1-3 hours Newbie friendliness 86/100

hashview/hashview#499 · 3 comments · Opened Sep 14, 2026

Currently no support for hashtypes that requires files, like 5300 Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

hashview/hashview#498 · Opened Sep 14, 2026

Customer name field exceeds db column length Open

Difficulty 3/5 1-2 days Newbie friendliness 58/100

hashview/hashview#497 · Opened Sep 14, 2026

Catalog: missing-file rules/wordlists that no task references are never cleaned up Open

enhancement

Difficulty 4/5 3-5 days Newbie friendliness 55/100

hashview/hashview#494 · Opened Sep 14, 2026

Replace the in-tree pure-Python MD4 with a maintained implementation Open

enhancement

hashview/hashview#490 · 1 assignee · Opened Sep 11, 2026

fig8 username==password download never decodes $HEX[...] passwords despite the comment Open

Analytics bug python

Difficulty 2/5 1-3 hours Newbie friendliness 88/100

hashview/hashview#470 · Opened Sep 7, 2026

fig9 shared-password download never decodes $HEX[...] usernames despite the comment Open

Analytics bug python

Difficulty 1/5 Under an hour Newbie friendliness 90/100

hashview/hashview#469 · Opened Sep 7, 2026

user:hash import stores the whole 'user:hash' line as the ciphertext for hash_type 300 and 1731 Open

bug Jobs python

Difficulty 2/5 1-3 hours Newbie friendliness 88/100

hashview/hashview#445 · 1 comment · Opened Sep 1, 2026

Hashfile import: hash_type is compared to strings, so the API path (int) skips all normalisation — NTLM hashes stored uppercase are never marked cracked Open

bug Jobs python Wordlists

Difficulty 2/5 1-3 hours Newbie friendliness 86/100

hashview/hashview#444 · 1 comment · Opened Sep 1, 2026

Import modal's "Checking for already-cracked" step is a 1.5s client-side timer, not real server progress Open

bug Jobs

Difficulty 2/5 1-3 hours Newbie friendliness 84/100

hashview/hashview#443 · Opened Aug 30, 2026

hashview/api/routes.py has grown to 2000+ lines / 30+ handlers — candidate for a sub-module split Open

Difficulty 4/5 3-5 days Newbie friendliness 55/100

hashview/hashview#441 · 1 comment · Opened Aug 28, 2026

/v1 JSON-body endpoints 500 on a valid-but-non-object body (e.g. a top-level JSON array) Open

Difficulty 4/5 3-5 days Newbie friendliness 68/100

hashview/hashview#440 · Opened Aug 28, 2026

Expand ruff lint scope beyond hashview/ to tests, agent, and migrations Open

enhancement Tests

Difficulty 4/5 3-5 days Newbie friendliness 48/100

hashview/hashview#437 · Opened Aug 27, 2026

Dashboard task ETA only reflects running chunks, so a 76-chunk task shows the ETA of the 4 in flight Open

bug Jobs python

Difficulty 4/5 3-5 days Newbie friendliness 48/100

hashview/hashview#427 · 2 comments · Opened Aug 24, 2026

bandit baseline is stale (18 entries, 16 reproduce), leaving file-scoped exemptions that would hide a shell=True regression Open

security Tests

Difficulty 3/5 1-2 days Newbie friendliness 72/100

hashview/hashview#426 · Opened Aug 22, 2026

pre-push hook passes rev-list args to git diff: secrets on a new-branch push are never scanned Open

bug security

Difficulty 3/5 1-2 days Newbie friendliness 74/100

hashview/hashview#418 · 1 comment · Opened Aug 21, 2026

Two clock domains share one schema: agent-timeout fallback compares Python UTC against DB-local last_checkin Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 52/100

hashview/hashview#404 · 1 comment · Opened Aug 19, 2026

Mask files bypass chunking and the ETA: planner sees keyspace 1, so a file of cheap masks runs whole on one agent Open

enhancement Jobs python

Difficulty 5/5 Over a week Newbie friendliness 38/100

hashview/hashview#402 · 4 comments · Opened Aug 19, 2026

API: no way to replace the contents of an existing rule or wordlist (no PUT /v1/rules/<id> or /v1/wordlists/<id>) Open

enhancement python Rules Wordlists

Difficulty 5/5 Over a week Newbie friendliness 45/100

hashview/hashview#399 · Opened Aug 18, 2026

API: no DELETE endpoint for /v1/wordlists/<id> (wordlists can be created but never deleted via API) Open

enhancement python Wordlists

Difficulty 3/5 1-2 days Newbie friendliness 76/100

hashview/hashview#398 · 2 comments · Opened Aug 18, 2026

setup: default "Rockyou" tasks are seeded with hardcoded wl_id 2/3 and actually point at empty dynamic wordlists Open

bug Jobs Wordlists

Difficulty 3/5 1-2 days Newbie friendliness 72/100

hashview/hashview#396 · Opened Aug 18, 2026

setup: default wordlist/rule seeding fails with EXDEV (os.replace) when control/ is a mount — blocks the volume fix for #383 Open

bug Rules Wordlists

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

hashview/hashview#395 · 1 comment · Opened Aug 18, 2026

Add task filter/search field to the job task-assignment page (jobs/<id>/tasks) Open

enhancement Jobs

Difficulty 2/5 1-3 hours Newbie friendliness 76/100

hashview/hashview#392 · 1 comment · Opened Aug 17, 2026

/analytics/download: unrecognised ?type discards its redirect and serves an empty attachment off a full-table scan Open

Difficulty 2/5 1-3 hours Newbie friendliness 82/100

hashview/hashview#389 · Opened Aug 15, 2026

Analytics: username=password download (fig8) is case-sensitive while the card is not Open

Difficulty 3/5 1-2 days Newbie friendliness 78/100

hashview/hashview#388 · Opened Aug 15, 2026

Analytics: /analytics/download/fig9 disagrees with the Shared Passwords card in both directions Open

Difficulty 3/5 1-2 days Newbie friendliness 74/100

hashview/hashview#387 · Opened Aug 15, 2026

Analytics: shared-password download returns an empty file for $HEX[...] plaintexts (card decodes, endpoint does not) Open

Difficulty 3/5 1-2 days Newbie friendliness 82/100

hashview/hashview#386 · Opened Aug 15, 2026

Mask files have no home: add a control/masks store + /v1/masks endpoints + agent sync Open

enhancement python

hashview/hashview#384 · 1 assignee · Opened Aug 14, 2026

jobs/routes.py:615: inert NULL filter in the lucky-task query (use .isnot(None)) Open

bug Jobs python

Difficulty 1/5 Under an hour Newbie friendliness 88/100

hashview/hashview#382 · Opened Aug 14, 2026

API: /v1/tasks/add only supports attack mode 0 — no mask, combinator, or hybrid tasks Open

enhancement python

Difficulty 4/5 3-5 days Newbie friendliness 68/100

hashview/hashview#381 · Opened Aug 14, 2026

Verify founds for unsupported hash types by delegating to hashcat instead of expanding in-tree crypto Open

Difficulty 5/5 Over a week Newbie friendliness 42/100

hashview/hashview#376 · Opened Jul 30, 2026

API: report how many founds are NEW on import (counterpart to instacracked) Open

Difficulty 4/5 3-5 days Newbie friendliness 67/100

hashview/hashview#374 · Opened Jul 30, 2026

distinct('col') is silently ignored on MySQL (4 call sites); customer-delete orphan check computes the wrong count Open

Difficulty 4/5 3-5 days Newbie friendliness 67/100

hashview/hashview#373 · Opened Jul 30, 2026

/v1 API activity is largely unaudited: auth events, all reads, and several state-changing endpoints never reach audit.log Open

Difficulty 5/5 Over a week Newbie friendliness 42/100

hashview/hashview#370 · Opened Jul 29, 2026

Feature parity: expose hashfile export formats over the /v1 API (UI ↔ API) Open

enhancement

Difficulty 4/5 3-5 days Newbie friendliness 58/100

hashview/hashview#368 · Opened Jul 25, 2026

Move hashfile import to the background so users don't wait on large hashsets Open

enhancement Jobs python

Difficulty 4/5 3-5 days Newbie friendliness 52/100

hashview/hashview#364 · 1 comment · Opened Jul 24, 2026

Select multiple hashfiles during job creation, combined into a new hashfile Open

enhancement

Difficulty 4/5 3-5 days Newbie friendliness 52/100

hashview/hashview#359 · Opened Jul 23, 2026

Audit: latin-1 usage — 1 data-corruption bug on hashfile download + cleanups Open

bug python

Difficulty 4/5 3-5 days Newbie friendliness 62/100

hashview/hashview#357 · Opened Jul 23, 2026

Cracked-hash import rejects hashcat $HEX[...] plaintexts Open

Difficulty 4/5 3-5 days Newbie friendliness 58/100

hashview/hashview#355 · Opened Jul 23, 2026

API: adopt flask-smorest to generate the OpenAPI spec from code (replaces hand-maintained openapi.yaml) Open

Difficulty 5/5 Over a week Newbie friendliness 30/100

hashview/hashview#350 · Opened Jul 22, 2026

Security: Do not publish API docs in production Open

Difficulty 4/5 3-5 days Newbie friendliness 48/100

hashview/hashview#349 · Opened Jul 22, 2026

Security (MEDIUM): missing CSRF protection on form-reading routes Open

security

Difficulty 4/5 3-5 days Newbie friendliness 58/100

hashview/hashview#298 · 1 comment · Opened Jun 30, 2026

Migrate off deprecated `authlib.jose` (→ `joserfc`) for password-reset tokens Open

bug python

Difficulty 3/5 1-2 days Newbie friendliness 68/100

hashview/hashview#254 · Opened Jun 19, 2026

API: N+1 queries in /v1/hashfiles/hash_type and /v1/jobs/add Open

enhancement python

Difficulty 3/5 1-2 days Newbie friendliness 68/100

hashview/hashview#228 · 4 comments · Opened Jun 15, 2026

API: AlchemyEncoder is a secret denylist, not an allowlist (leak risk) Open

python security

Difficulty 4/5 3-5 days Newbie friendliness 48/100

hashview/hashview#223 · 1 comment · Opened Jun 15, 2026

API: unauthorized responses return HTTP 200 instead of 401/403 Open

enhancement python security

Difficulty 4/5 3-5 days Newbie friendliness 58/100

hashview/hashview#221 · Opened Jun 15, 2026

hashview

Get new issues in your inbox