Password Crack Time Calculator

Crack time depends on two factors: the password's entropy (unpredictability) and the attacker's speed. A throttled online login makes even a moderately weak password survive for days. But an offline GPU cluster attacking a weak hash can crack a 40-bit entropy password in seconds. The single most important factor is password entropy — which is determined by length and character variety.

An online attack attempts to log in directly — the attacker is limited by server rate limits, lockouts, and network latency (typically 10–10,000 guesses/second). An offline attack occurs when an attacker has stolen a copy of the password database and runs cracking software locally. Without server-side restrictions, speeds are limited only by the attacker's hardware and the hash algorithm used.

Password hashing algorithms differ enormously in speed. MD5 was designed for data integrity checks — it is extremely fast (trillions of guesses per second on a GPU). bcrypt was specifically designed for passwords — it is deliberately slow and configurable (thousands of guesses per second). A site using bcrypt makes offline cracking millions of times harder than one using MD5, for the same password.

No — these estimates assume pure brute-force, which is the worst-case for attackers. In practice, attackers use dictionaries, rule-based mangling, and Markov-chain models that exploit human predictability. A human-chosen password like "Fluffy2023!" may have a theoretical entropy of ~40 bits, but would be cracked in seconds by a dictionary attack. Randomly generated passwords have close alignment between theoretical and practical crack time.