Hash Speed Calculator
Estimate hashing throughput and time-to-complete by algorithm — MD5, SHA-256, SHA-512, bcrypt.
Inputs
Effective Aggregate Throughput
3 GB/s (aggregate across 1 device)
Estimated Time (seconds)
0.333333
Estimated Time (milliseconds)
333.333
Step by step
Values used
Hash Algorithm = SHA-256 (~3 GB/s per modern GPU); Data to Hash (MB) — ignored for bcrypt = 1,024; Number of Hashes (for bcrypt / password cracking estimate) = 1,000,000; Number of GPUs/Devices in Parallel = 1
Estimated processing time
time_seconds = data_bytes / (throughput_bytes_per_sec × device_count) [or count / (hashes_per_sec × device_count) for bcrypt]
Effective Aggregate Throughput
= 3 GB/s (aggregate across 1 device)
Estimated Time (seconds)
= 0.333333
Estimated Time (milliseconds)
= 333.333
How it works
Different cryptographic hash algorithms have dramatically different computational costs by design: fast general-purpose digests like MD5 and SHA-256/512 are optimized for speed (useful for checksums and data integrity) and can be computed at multiple gigabytes per second on modern GPU hardware, which is precisely why they are unsuitable for password storage — an attacker with the same hardware can attempt billions of guesses per second. Purpose-built password-hashing algorithms like bcrypt are deliberately slow (measured in mere tens of thousands of hashes per second even on capable hardware) and tunable via a work-factor/cost parameter, trading throughput for resistance against brute-force and GPU-accelerated cracking attempts.
Formula
Estimated processing time
time_seconds = data_bytes / (throughput_bytes_per_sec × device_count) [or count / (hashes_per_sec × device_count) for bcrypt]
- D
- data size (bytes) or hash count
- R
- per-device throughput
- n
- number of parallel devices
Frequently Asked Questions
Why is bcrypt so much slower than SHA-256 by design?
bcrypt deliberately incorporates a tunable cost factor and memory-access patterns designed to resist parallelization on GPUs and ASICs, unlike general-purpose hashes optimized purely for raw speed — this intentional slowness is the entire point for password storage, since it makes brute-force attacks proportionally more expensive even with powerful cracking hardware.
Should I ever use MD5 or SHA-256 for password hashing?
No — neither is designed for password storage. Use a purpose-built password hashing algorithm such as bcrypt, scrypt, or Argon2, all of which include deliberate computational or memory cost and, ideally, a per-password salt; MD5/SHA-256/512 remain appropriate for data integrity checksums, not credential storage.
How accurate are these GB/s and hashes/sec figures?
They're representative order-of-magnitude figures for capable modern GPU hardware and vary by specific device, driver, and implementation (e.g. actual hashcat/John the Ripper benchmarks differ by GPU model and algorithm mode) — use this calculator for rough capacity/risk estimation, and consult tool-specific benchmark output (`hashcat -b`) for hardware-accurate numbers.