Password Crack Time Calculator

average crack time = charset^length ÷ (2 × guesses per second × rigs). The keyspace is every password of that length over that character set. Dividing by two gives the expected number of guesses, since the target sits at a random point in the search order. Dividing that by the attacker's throughput gives the time — and throughput is dominated by the hash, not the hardware: the same rig does 100 billion MD5 guesses per second but only 30,000 bcrypt guesses.

It shows why the hash choice matters more than the password policy: moving from SHA-256 to bcrypt buys about 19 bits of effective strength, more than adding three characters to every password in the estimate.

This calculator takes 4 inputs: Password length, Character set, Password hash, Number of 8-GPU rigs. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Brute force finds the answer after searching, on average, half the keyspace. The full keyspace divided by the rate is the worst case; halving it gives the expected case, which is the fairer planning figure.

No. This models an attacker who has stolen the hash database and cracks offline at full GPU speed. An online attacker is limited by your rate limiting and lockout policy, typically to a few guesses per minute — use the account lockout and credential stuffing calculators for that case.