Password Crack Time Estimator

Introduction

How long would it take to crack your password? Not in theory — with actual hardware. The Password Crack Time Estimator calculates real-world crack times using current GPU capabilities, from a single consumer graphics card to a nation-state-level cluster. It accounts for attack type (online rate-limited vs. offline brute-force), hash algorithm (MD5, SHA-256, bcrypt), and hardware scale. This is the number your security team needs to see.

What This Tool Does

A password crack time estimator is a tool that converts password entropy into concrete time estimates under realistic attack scenarios. It models three hardware scales (single consumer GPU, 8-GPU mining rig, 100-rig nation-state cluster), seven hash algorithms (MD5, SHA-1, SHA-256, SHA-512, bcrypt, scrypt, Argon2), and two attack types (online rate-limited at 100 guesses/second, offline unlimited at billions of guesses/second). The output shows both average-case (searching half the space) and worst-case (exhausting the full space) crack times, enabling security professionals to make informed decisions about password requirements, hash algorithm selection, and infrastructure investment.

Why It Matters

How It Works

The estimator calculates entropy from the password (L × log₂(R)), then computes combinations as 2^entropy. It divides by the guessing speed for the selected hash algorithm and hardware scale. MD5: ~63 billion guesses/second per GPU (Hashcat benchmarks). SHA-256: ~13 billion/second. bcrypt (cost 12): ~11,000/second — 5.7 million times slower than MD5. Argon2id: ~5,000/second — 12.6 million times slower. For online attacks, the speed is capped at 100 guesses/second by rate limiting. Average case assumes searching half the space; worst case assumes exhaustive search. Results are formatted in human-readable time units from instant to centuries.

Step-by-Step Examples

Code Examples

function estimateCrackTime(password, options = {}) {
  const { hashType = 'md5', attackType = 'offline', hardwareScale = 'single-gpu' } = options;

  let poolSize = 0;
  if (/[a-z]/.test(password)) poolSize += 26;
  if (/[A-Z]/.test(password)) poolSize += 26;
  if (/[0-9]/.test(password)) poolSize += 10;
  if (/[^a-zA-Z0-9]/.test(password)) poolSize += 33;

  const entropy = password.length * Math.log2(poolSize);
  const combinations = Math.pow(2, entropy);

  const speeds = {
    md5: { 'single-gpu': 6.3e10, '8-gpu': 5e11, 'cluster': 5e12 },
    sha256: { 'single-gpu': 1.3e10, '8-gpu': 1e11, 'cluster': 1e12 },
    bcrypt12: { 'single-gpu': 1.1e4, '8-gpu': 8.8e4, 'cluster': 8.8e5 },
    argon2: { 'single-gpu': 5e3, '8-gpu': 4e4, 'cluster': 4e5 }
  };

  const guessesPerSec = attackType === 'online' ? 100 : (speeds[hashType]?.[hardwareScale] || 6.3e10);
  const avgTimeSeconds = (combinations / 2) / guessesPerSec;

  return {
    entropyBits: entropy.toFixed(1),
    combinations: combinations.toExponential(2),
    avgCrackTime: formatTime(avgTimeSeconds),
    hashType, attackType, hardwareScale
  };
}

function formatTime(seconds) {
  if (seconds < 1) return 'instant';
  if (seconds < 60) return seconds.toFixed(0) + ' seconds';
  if (seconds < 3600) return (seconds / 60).toFixed(0) + ' minutes';
  if (seconds < 86400) return (seconds / 3600).toFixed(0) + ' hours';
  if (seconds < 31536000) return (seconds / 86400).toFixed(0) + ' days';
  return (seconds / 31536000).toExponential(1) + ' years';
}

console.log(estimateCrackTime('k9mP2xNq7rL4vW8y', { hashType: 'bcrypt12', hardwareScale: 'cluster' }));
// { avgCrackTime: "1.3 × 10⁹ years" }

function compareAttackScenarios(password) {
  const scenarios = [
    { name: 'Online (rate-limited)', hashType: 'md5', attackType: 'online' },
    { name: 'Offline MD5 (single GPU)', hashType: 'md5', attackType: 'offline', hardwareScale: 'single-gpu' },
    { name: 'Offline MD5 (8-GPU rig)', hashType: 'md5', attackType: 'offline', hardwareScale: '8-gpu' },
    { name: 'Offline bcrypt (cluster)', hashType: 'bcrypt12', attackType: 'offline', hardwareScale: 'cluster' },
    { name: 'Offline Argon2 (cluster)', hashType: 'argon2', attackType: 'offline', hardwareScale: 'cluster' }
  ];

  return scenarios.map(s => ({
    scenario: s.name,
    ...estimateCrackTime(password, s)
  }));
}

Benefits

• Estimates crack times for 7 different hash algorithms: MD5, SHA-1, SHA-256, SHA-512, bcrypt, scrypt, and Argon2.
• Models 3 hardware scales: single consumer GPU, 8-GPU mining rig, and 100-rig nation-state cluster.
• Separates online (rate-limited) and offline (unlimited) attack scenarios for realistic threat assessment.
• Shows how hash algorithm choice impacts crack time — bcrypt can make a password millions of times harder to crack than MD5.
• Provides both average-case and worst-case crack time estimates for comprehensive risk assessment.

Use Cases

Common Mistakes to Avoid

Security Implications

Security Information

All calculations run locally. Crack time estimates are based on published Hashcat benchmarks and academic research on GPU cracking speeds. The estimates assume optimal attack configurations — real-world performance may vary based on system constraints. The tool is designed to show relative differences between algorithms and hardware scales, not absolute guarantees.

Best Practices

• Use bcrypt (cost 12+) or Argon2id for password storage — they are millions of times slower to crack than MD5.
• Require 12+ character passwords to ensure resistance against offline GPU attacks even with weak hash algorithms.
• Implement rate limiting on online login attempts to limit attackers to ~100 guesses/second.
• If your system uses MD5 or SHA-1 for password hashing, migrate to bcrypt or Argon2 immediately — this is a critical security vulnerability.
• Use the offline attack estimates, not online estimates, when evaluating password security — breaches enable offline attacks.