Skip to content
ENExplore Calculators

Brute Force Attack Time Calculator

Work out worst-case and average brute-force time for any keyspace at an attack rate you set yourself.

About Brute Force Attack Time Calculator

Brute force is a linear search of a space that grows exponentially with length, so the time is simply the space divided by the rate. Doubling the attacker's hardware halves the time, but adding one character multiplies it by the charset size — 62× for an alphanumeric secret. Separating worst case from average stops the two figures being quoted interchangeably in risk write-ups, and expressing the same secret in bits lets you compare a password against a cryptographic key on one scale.

Formula

Brute Force Attack Time

worst case = keyspace ÷ rate, average = keyspace ÷ (2 × rate), where keyspace = charset^length.

keyspace
charset size raised to the length
rate
Guesses per second the attacker sustains

Worked example

With the default values below, Brute Force Attack Time Calculator returns Average Time to Exhaust of 48.6 days. Change any input above and every figure here is recalculated in your browser.

Inputs used

Secret lengthaccepts 1–64 characters
10 characters
Character setone of Digits only (10), Lowercase letters (26), Mixed-case letters (52), Alphanumeric (62), Printable ASCII (95)
Alphanumeric (62)
Attack rateaccepts 1–100,000
100
Rate scaleone of guesses per second, thousand per second, million per second, billion per second, trillion per second
billion per second

Results

Average Time to Exhaust
48.6 days
Average Time in Seconds
4.196 × 10⁶ seconds
Worst-Case Time in Seconds
8.393 × 10⁶ seconds
Average Time in Years
1.331 × 10⁻¹ years
Equivalent Key Strength
59.5 bits

Step by step

  1. 1Values used
  2. 2Brute Force Attack Time
  3. 3Average Time to Exhaust= 48.6 days
  4. 4Average Time in Seconds= 4,196,496.829 seconds
  5. 5Worst-Case Time in Seconds= 8,392,993.659 seconds
  6. 6Average Time in Years= 0.133 years
  7. 7Equivalent Key Strength= 59.5 bits

Assumptions and limits

  • The result is derived only from the 4 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 3 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Brute Force Attack Time calculated?

worst case = keyspace ÷ rate, average = keyspace ÷ (2 × rate), where keyspace = charset^length. Brute force is a linear search of a space that grows exponentially with length, so the time is simply the space divided by the rate. Doubling the attacker's hardware halves the time, but adding one character multiplies it by the charset size — 62× for an alphanumeric secret.

Why does Brute Force Attack Time matter?

Separating worst case from average stops the two figures being quoted interchangeably in risk write-ups, and expressing the same secret in bits lets you compare a password against a cryptographic key on one scale.

What values do I need to enter?

This calculator takes 4 inputs: Secret length, Character set, Attack rate, Rate scale. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

How fast can a real attacker actually guess?

A single high-end GPU does roughly 10^10 MD5 guesses per second; an 8-GPU rig about 10^11. Rented cloud capacity scales that linearly for money. Against a memory-hard hash such as Argon2id the same rig manages only about 5×10^3, which is why the rate is a field here rather than a constant.

Why show equivalent bits?

Bits let you compare unlike things. A 10-character alphanumeric password is 59.5 bits — weaker than a 64-bit key and vastly weaker than the 128-bit key protecting the TLS session it travels over.

Related Calculators

Brute Force Attack Time Calculator | Calcrivo