Estimate hashing throughput and brute-force crack time for a given hash algorithm.
Different cryptographic hash algorithms have dramatically different computational costs by design: fast general-purpose digests like MD5 and SHA-256/512 are optimized for speed (useful for checksums and data integrity) and can be computed at multiple gigabytes per second on modern GPU hardware, which is precisely why they are unsuitable for password storage — an attacker with the same hardware can attempt billions of guesses per second. Purpose-built password-hashing algorithms like bcrypt are deliberately slow (measured in mere tens of thousands of hashes per second even on capable hardware) and tunable via a work-factor/cost parameter, trading throughput for resistance against brute-force and GPU-accelerated cracking attempts.
Estimated processing time
time_seconds = data_bytes / (throughput_bytes_per_sec × device_count) [or count / (hashes_per_sec × device_count) for bcrypt]
bcrypt deliberately incorporates a tunable cost factor and memory-access patterns designed to resist parallelization on GPUs and ASICs, unlike general-purpose hashes optimized purely for raw speed — this intentional slowness is the entire point for password storage, since it makes brute-force attacks proportionally more expensive even with powerful cracking hardware.
No — neither is designed for password storage. Use a purpose-built password hashing algorithm such as bcrypt, scrypt, or Argon2, all of which include deliberate computational or memory cost and, ideally, a per-password salt; MD5/SHA-256/512 remain appropriate for data integrity checksums, not credential storage.
They're representative order-of-magnitude figures for capable modern GPU hardware and vary by specific device, driver, and implementation (e.g. actual hashcat/John the Ripper benchmarks differ by GPU model and algorithm mode) — use this calculator for rough capacity/risk estimation, and consult tool-specific benchmark output (`hashcat -b`) for hardware-accurate numbers.