API Reference

API Reference

All responses are JSON unless noted. Management endpoints require a logged-in session cookie (log in via POST /login). Admin endpoints additionally require an admin user.

Authentication

Method	Path	Description
GET	/login	Login page
POST	/login	Form fields username, password. Sets the session cookie.
POST	/logout	Ends the session
GET	/api/user	Current user

Jobs

Method	Path	Description
GET	/api/jobs	Your jobs. Admins may add ?show_all=true.
POST	/api/jobs	Create a job (multipart form, see below)
GET	/api/jobs/:uid	Job details and per-worker progress
GET	/api/jobs/:uid/cracked	Paginated cracked hashes
GET	/api/jobs/:uid/copy	Job settings and hashes for pre-filling a copy
POST	/api/jobs/:uid/cancel	Cancel
DELETE	/api/jobs/:uid	Delete
GET	/api/jobs/:uid/export/cracked	CSV of cracked hashes
GET	/api/jobs/:uid/export/all	CSV of all hashes
GET	/api/jobs/:uid/export/potfile	DPAT potfile (mode 1000 only)
GET	/api/jobs/wordlists	Available wordlists
GET	/api/jobs/rulesets	Available rulesets
GET	/api/jobs/hash-modes	Available hash modes

Users can only access their own jobs; admins can access all.

Create Job Form Fields

Field	Required	Notes
name	Yes
hash_mode	Yes	Integer hashcat mode
hashes_text	One of	Newline-separated hashes
hashes_file	One of	File upload; takes precedence over hashes_text
wordlist	One of	Path as returned by /api/jobs/wordlists
wordlist_file	One of	Custom wordlist upload
rulesets	No	Repeat the field for multiple rulesets; empty values are ignored
disable_potfile	No	true or on
username_mode	No	true or on
webhook_url	No	See Webhooks

Example:

curl -b cookies.txt -X POST http://hashtasker:8080/api/jobs \
  -F name="ACME NTDS" \
  -F hash_mode=1000 \
  -F hashes_file=@ntds.txt \
  -F wordlist=/crack/wordlists/rockyou.txt \
  -F rulesets=/crack/rules/best64.rule \
  -F rulesets=/crack/rules/OneRuleToRuleThemAll.rule

The response contains job_uid on success, or error with a reason.

Dashboard and Stats

Method	Path	Description
GET	/api/dashboard/stats	Dashboard data, including wordlist mode and NFS health
GET	/api/system/stats	Per-worker hardware and status

Users

Method	Path	Description
PUT	/api/user/password	Change your own local password
GET	/api/admin/users	List users (admin)
POST	/api/admin/users	Create a local user (admin)
PUT	/api/admin/users/:id	Update a user (admin)
PUT	/api/admin/users/:id/password	Reset a password (admin)
DELETE	/api/admin/users/:id	Delete a user (admin)

Analytics

Method	Path	Description
GET	/api/admin/analytics	Analytics data (admin)
DELETE	/api/admin/analytics	Clear all analytics (admin)

Worker API (unauthenticated)

Used by hashtasker-worker. See Security Hardening before exposing these.

Method	Path	Description
POST	/api/worker/stats	Check-in: hostname, hardware stats, NFS health
GET	/api/worker/assignments	Pending chunks for this worker
GET	/api/worker/wordlist/:job_uid/:chunk_index	Download a push-mode wordlist chunk
GET	/api/worker/custom-wordlist/:job_uid	Download an uploaded custom wordlist (NFS mode)
POST	/api/worker/progress	Speed, percent, ETA for a running chunk
POST	/api/worker/cracked/:job_uid	Report a cracked hash
POST	/api/worker/chunk/:job_uid/:chunk_index/status	Chunk status, with an optional failure message