Password strength checker

Password tested here, never sent

Show it

Or enter entropy in bits

The attacker has1 graphics card (RTX 4090)8 cards (one rig)1,000 cards (a well-funded attacker)100,000 cards (a state)

The password you type is analyzed in this page and never leaves it. Even so, test a password like yours, not the one you actually use.

This password strength checker estimates how long a password or passphrase would take to crack, using real benchmark speeds for four ways of storing it: unsalted MD5, unsalted SHA-256, bcrypt and PBKDF2. Everything runs in your browser. The number depends on the storage method as much as on the password, and the sections below explain what it assumes.

What the numbers assume

The table shows how long an attacker with a given amount of hardware would need, on average, to find a password. It assumes they have a copy of how it was stored (a leaked database, say, or a stolen encrypted file) and can try guesses offline as fast as their hardware allows. That's exactly the position of someone attacking a cipher.ink message with a passphrase. Anyone with the link can download the ciphertext and try passphrases on their own machines, and nothing rate-limits them. A website login with lockouts is different, since the attacker gets only a few guesses.

• Speeds are measured, not guessed. They come from the hashcat 6.2.6 benchmark for one NVIDIA RTX 4090, published on 14 October 2022 (source). Where the benchmark used a particular iteration count we scaled it. PBKDF2-HMAC-SHA256 ran 999 rounds at 8,865.7 kH/s, about 8.86 billion rounds a second per card, so 600,000 rounds comes to about 14,800 guesses a second per card. The benchmark's own Bitwarden figure (100,000 rounds, 92,022 per second) agrees with that scaling. Hover a rate in the table to see its source.
• "Average" means half of the whole space of possible passwords. A lucky attacker is faster and an unlucky one slower.
• Entropy is our estimate of how many guesses a smart attacker needs, and it's the weak link. For a password you type, the tool takes the lowest of several models (a short list of common passwords, words from the EFF list with extras, keyboard patterns, brute force over the characters used) and tells you which one won. Real attackers hold breach lists with hundreds of millions of leaked passwords, so a password that has appeared in a leak is weak whatever the number says. If you enter bits instead, you're asserting the password was chosen at random.
• Hardware moves. A 2022 card is already two generations old, and attack hardware keeps getting faster. The 1,000-card and 100,000-card options are there so you can see how much margin you have.
• Argon2id isn't in the table, because the benchmark we cite doesn't include it and we won't invent a number. It's designed so that memory, not arithmetic, limits the attacker.

The storage method matters as much as the password

scripts/examples/crack-time-table.mjs computed this table from the same rates the page uses. It shows the average time for one RTX 4090 to find a password of each strength under four storage methods:

Read across a row. The same 60-bit secret falls in 41 days when it's stored as an unsalted MD5, and holds out for over a million years under 600,000 rounds of PBKDF2. That speed ratio of 11 million between the fastest and slowest column is the whole point of slow password hashing. It's also why cipher.ink derives a key from your passphrase with PBKDF2 at 600,000 rounds (what those rounds do). We use PBKDF2 because every browser provides it natively, and bcrypt isn't available to us. The table shows bcrypt at cost 12 running about ten times slower for an attacker than PBKDF2 at 600,000, which is a fair summary of the trade-off. bcrypt, scrypt, Argon2 and PBKDF2 compared covers the options.

How many bits is enough?

There's no single threshold, because it depends on the attacker and the storage, but the table gives an honest feel. For something an attacker can attack offline with a fast hash, 70 bits is about a century of one card's work and a few weeks for a thousand cards, and 80 bits or more is comfortable. Behind a slow hash like PBKDF2 at 600,000 rounds, 60 bits is already beyond one card and takes a 1,000-card cluster about 1,200 years. At 70 bits you're beyond everyone. The generators make this easy to reach. Six words from the EFF list (passphrase generator) give 77.5 bits, and a 14-character random password (password generator) from the 94 printable characters gives 92.

What matters more than any of these numbers is not reusing passwords and using a manager. The estimator can't tell you that your password is already in a leak, or that the site storing it uses unsalted MD5, as in the left column. To find out whether a password has appeared in a breach, try Have I Been Pwned's Pwned Passwords, which supports a k-anonymity lookup that sends only the first five characters of a hash. This page doesn't do that, because it makes no network requests at all.

Common questions