Skip to content
ENExplore Calculators

Password Crack Time Calculator

Estimate how long an offline attack needs to crack a password, using real GPU hash rates for MD5, bcrypt and Argon2id.

About Password Crack Time Calculator

The keyspace is every password of that length over that character set. Dividing by two gives the expected number of guesses, since the target sits at a random point in the search order. Dividing that by the attacker's throughput gives the time — and throughput is dominated by the hash, not the hardware: the same rig does 100 billion MD5 guesses per second but only 30,000 bcrypt guesses. It shows why the hash choice matters more than the password policy: moving from SHA-256 to bcrypt buys about 19 bits of effective strength, more than adding three characters to every password in the estimate.

Formulas

Password Crack Time

average crack time = charset^length ÷ (2 × guesses per second × rigs).

2
On average an attacker finds the password halfway through the keyspace
charset^length
Size of the keyspace to search

Reference GPU hash rates

Hash rates on one 8-GPU rig: NTLM 3.5×10^11, MD5 1×10^11, SHA-256 1×10^10, bcrypt cost 12 3×10^4, Argon2id 5×10^3 guesses per second.

Worked example

With the default values below, Password Crack Time Calculator returns Average Time to Crack of 856,735 years. Change any input above and every figure here is recalculated in your browser.

Inputs used

Password lengthaccepts 1–64 characters
12 characters
Character setone of Digits only (10), Lowercase letters (26), Mixed-case letters (52), Alphanumeric (62), Printable ASCII (95)
Printable ASCII (95)
Password hashone of NTLM — 350 G/s, MD5 — 100 G/s, SHA-1 — 50 G/s, SHA-256 — 10 G/s, bcrypt cost 12 — 30 k/s, PBKDF2-SHA256 600k — 20 k/s, Argon2id 64 MiB — 5 k/s
SHA-256 — 10 G/s
Number of 8-GPU rigsaccepts 1–10,000 rigs
1 rigs

Results

Average Time to Crack
856,735 years
Average Time in Seconds
2.702 × 10¹³ seconds
Average Time in Years
8.567 × 10⁵ years
Total Keyspace
5.404 × 10²³
Attack Rate
1.000 × 10¹⁰ guesses/s

Step by step

  1. 1Values used
  2. 2Password Crack Time
  3. 3Reference GPU hash rates
  4. 4Average Time to Crack= 856,735 years
  5. 5Average Time in Seconds= 27,018,004,383,131.848 seconds
  6. 6Average Time in Years= 856,735.299 years
  7. 7Total Keyspace= 540,360,087,662,637,000,000,000.000
  8. 8Attack Rate= 10,000,000,000.000 guesses/s

Assumptions and limits

  • The result is derived only from the 4 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 3 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Password Crack Time calculated?

average crack time = charset^length ÷ (2 × guesses per second × rigs). The keyspace is every password of that length over that character set. Dividing by two gives the expected number of guesses, since the target sits at a random point in the search order. Dividing that by the attacker's throughput gives the time — and throughput is dominated by the hash, not the hardware: the same rig does 100 billion MD5 guesses per second but only 30,000 bcrypt guesses.

Why does Password Crack Time matter?

It shows why the hash choice matters more than the password policy: moving from SHA-256 to bcrypt buys about 19 bits of effective strength, more than adding three characters to every password in the estimate.

What values do I need to enter?

This calculator takes 4 inputs: Password length, Character set, Password hash, Number of 8-GPU rigs. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Why divide by two?

Brute force finds the answer after searching, on average, half the keyspace. The full keyspace divided by the rate is the worst case; halving it gives the expected case, which is the fairer planning figure.

Does this apply to online attacks?

No. This models an attacker who has stolen the hash database and cracks offline at full GPU speed. An online attacker is limited by your rate limiting and lockout policy, typically to a few guesses per minute — use the account lockout and credential stuffing calculators for that case.

Related Calculators

Password Crack Time Calculator | Calcrivo