Learn · Practical guides
How long would it take to crack my password?
It depends on how strong the password is and how the site stores it: the same six-word passphrase takes 20,000 years against MD5 and 229 billion against PBKDF2.
How long it takes to crack a password depends on two things: how unpredictable the password is and how the site or program stored it. A random six-word passphrase (77.5 bits) behind a slow key-stretching method such as PBKDF2 would take one high-end graphics card about 229 billion years to find on average. The same passphrase stored as a plain MD5 hash would take about 20,000 years, and an eight-character password that follows common habits can fall in seconds either way. The estimator below does the arithmetic for your own password, in your browser, and nothing you type leaves the page.
The password you type is analyzed in this page and never leaves it. Even so, test a password like yours, not the one you actually use.
Two numbers set the answer
How many guesses the password needs
The password's origin sets the count. Eight random characters from the 94 you can type give about 52 bits, so an attacker tries on average 251 of the 252 possibilities before finding it. A password a person made up is much weaker than its length suggests, because people choose from a tiny, predictable corner of the space: a name or word, a number, a symbol at the end. Cracking tools try those first, so the real work is often millions of times smaller than the arithmetic for "eight characters" suggests. The estimator's strength figure is a conservative model of that, not a promise. A random passphrase is how you know your number instead of guessing it.
How fast the attacker can test a guess
Here the storage method decides, and it matters more than most people expect. A service stores a hash of your password, not the password. If the database leaks, the attacker tries guesses offline, hashing each one until it matches, at the speed of their hardware. These rates come from the hashcat 6.2.6 benchmark for a single Nvidia RTX 4090, published in October 2022:
| How the password is stored | Guesses per second, one RTX 4090 |
|---|---|
| MD5 (fast, unsalted) | 164 billion |
| SHA-1 | 51 billion |
| SHA-256 | 22 billion |
| sha512crypt (Linux $6$) | 1.2 million |
| PBKDF2-HMAC-SHA256, 10,000 rounds | 886,000 |
| PBKDF2-HMAC-SHA256, 100,000 rounds | 89,000 |
| PBKDF2-HMAC-SHA256, 600,000 rounds (what cipher.ink uses) | 14,800 |
| scrypt (N=16384) | 7,100 |
| bcrypt, cost 12 | 1,400 |
A fast hash lets the attacker test eleven million times as many guesses per second against MD5 as against 600,000-round PBKDF2 (164 billion against 14,800). That ratio is why modern systems use deliberately slow functions (password hashing, PBKDF2), and it's why the same password has very different lifetimes in different places.
Same passwords, four ways of storing them
This is the average time one RTX 4090 needs to find a password of each strength. It comes from scripts/examples/crack-time-table.mjs, the same model as the estimator above. "Average" means half of the whole search space, since a random password turns up about halfway through.
| Strength | MD5 | SHA-256 | bcrypt, cost 12 | PBKDF2, 600,000 rounds |
|---|---|---|---|---|
| 40 bits | 3.4 seconds | 25 seconds | 12 years | 1.2 years |
| 50 bits | 57 minutes | 7.1 hours | 12,410 years | 1,208 years |
| 60 bits | 41 days | 304 days | 13 million years | 1.2 million years |
| 70 bits | 114 years | 851 years | 13 billion years | 1.3 billion years |
| 77.5 bits (six random words) | 20,634 years | 154,082 years | 2,355 billion years | 229 billion years |
| 90 bits | 120 million years | 893 million years | about 1016 years | about 1015 years |
Take the 40-bit row, roughly an eight-character password made by a person following common habits. A fast hash loses it in seconds. Against PBKDF2 at 600,000 rounds it holds for over a year on one card, which shrinks to ten hours against an attacker with a thousand cards. At 60 bits, a leaked fast-hash database falls in weeks, while the slow one holds for a million years. At 77.5 bits, even the weak storage lasts thousands of years. Hardware keeps improving, so read the margin as a few orders of magnitude and not an exact figure.
Online guessing is a different problem
Every number above is for an offline attack, where the attacker holds a copy of the stored hashes or an encrypted file and runs guesses as fast as the hardware allows. At a website's login form, the attacker gets only a few guesses a second before the site slows or locks them out, so a 40-bit password is far safer there. The attack to plan for is the offline one, because database breaches do happen. If a site stored your password badly, strength is all that stands between a leak and your password.
What to do about it
- Make passwords long and random. Let a password manager generate a random one for each site, and use a six-word passphrase for the few secrets you memorize.
- Never reuse a password. Attackers who crack one site try the result everywhere else.
- Turn on two-factor authentication where it exists (how 2FA codes work), so a cracked password isn't enough.
- Don't trust a strength meter on its own. A meter doesn't know how the site stores the password, and it often just counts character types.
Here's what cipher.ink does. A message in passphrase mode is encrypted with a key derived by PBKDF2-HMAC-SHA256 with rounds and a random -byte salt, which holds every guess to the 14,800-per-second rate in the table. A short passphrase isn't saved by that. So the editor's meter grades what you type, and the dice make a strong one for you.
Common questions
Is the estimator accurate?
It's a model with stated assumptions: published benchmark rates for one graphics card scaled to bigger rigs, an average-case search, and a conservative strength estimate for human-chosen passwords. It gives you the order of magnitude, and it's better at comparing two choices than at predicting one exact number.
Do quantum computers change these numbers?
For guessing passwords, a quantum computer running Grover's algorithm would roughly halve the strength in bits, so a 77-bit passphrase would act like about 38 bits. That's a reason to use a long passphrase and a slow hash, and it doesn't make a good one useless. Today's quantum computers are nowhere near able to do it.
Why isn't a longer password always better in the table?
Length helps only if the extra characters are unpredictable. A 20-character sentence from a song can be weaker than eight random characters. What counts is the bits, and those come from how the password was chosen.