Skip to content
ENExplore Calculators

Brute Force Attempts Calculator

Work out brute force attempts instantly with clear inputs, formula shown and shareable results.

About Brute Force Attempts Calculator

A password drawn uniformly from a charset of size C at length L has C^L possible values and L x log2(C) bits of entropy. An attacker expects to find it after searching half the keyspace, so average time is C^L / (2 x guess rate). Guess rates vary enormously by hash: billions per second for unsalted MD5 on a GPU cluster, a few thousand per second for bcrypt at cost 12.

Formula

Brute-force time

keyspace = C^L; entropy = L x log2(C); average time = C^L / (2 x guesses per second)

C
Character set size
L
Password length

Worked example

With the default values below, Brute Force Attempts Calculator returns Average time to crack (half the keyspace) of 216.66 days. Change any input above and every figure here is recalculated in your browser.

Inputs used

Character set sizeaccepts 2–256
72
Password lengthaccepts 1–128
10
Guesses per secondminimum 1
100,000,000,000

Results

Average time to crack (half the keyspace)
216.66 days
Entropy
61.70 bits
Total combinations
10^18.57
Worst-case exhaustive search
433.32 days

Step by step

  1. 1Values used
  2. 2Brute-force time
  3. 3Average time to crack (half the keyspace)= 216.66 days
  4. 4Entropy= 61.70 bits
  5. 5Total combinations= 10^18.57
  6. 6Worst-case exhaustive search= 433.32 days

Assumptions and limits

  • The result is derived only from the 3 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

Does this reflect real attacks?

No. Real attackers use dictionaries, leaked-password lists and rule-based mangling first, which break human-chosen passwords far faster than brute force. This is the upper bound for a truly random password.

What guess rate should I assume?

Match it to the hash. Modern GPUs manage hundreds of billions per second against MD5 or SHA-1, but only tens of thousands against bcrypt, scrypt or Argon2 with sound parameters.

Related Calculators

Brute Force Attempts Calculator | Calcrivo