Brute Force Attack Time Calculator

worst case = keyspace ÷ rate, average = keyspace ÷ (2 × rate), where keyspace = charset^length. Brute force is a linear search of a space that grows exponentially with length, so the time is simply the space divided by the rate. Doubling the attacker's hardware halves the time, but adding one character multiplies it by the charset size — 62× for an alphanumeric secret.

Separating worst case from average stops the two figures being quoted interchangeably in risk write-ups, and expressing the same secret in bits lets you compare a password against a cryptographic key on one scale.

This calculator takes 4 inputs: Secret length, Character set, Attack rate, Rate scale. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

A single high-end GPU does roughly 10^10 MD5 guesses per second; an 8-GPU rig about 10^11. Rented cloud capacity scales that linearly for money. Against a memory-hard hash such as Argon2id the same rig manages only about 5×10^3, which is why the rate is a field here rather than a constant.

Bits let you compare unlike things. A 10-character alphanumeric password is 59.5 bits — weaker than a 64-bit key and vastly weaker than the 128-bit key protecting the TLS session it travels over.