Estimate How Long It Takes to Crack a Password
Every password has a cracking time: the expected duration of a brute-force attack that tries every combination until it finds a match. The Hash Crack-Time Estimator computes a rough figure from the password length, the character pool it draws from, and the attack speed you select. You need this tool when a password checker tells you something is "strong" and you want to know what that means in actual hours, days, or years — and when you are deciding whether a legacy password is worth keeping at all.
How to Estimate Crack Time
- Enter the password or passphrase you want to evaluate in the input field.
- Confirm the character pool detected so the estimate reflects the real search space.
- Pick the attack scenario — online login, offline hash cracking, or a fast GPU rig.
- Read the estimated time, which scales from seconds to centuries depending on the scenario.
- Compare scenarios to decide if the password survives the worst realistic threat.
Real Example: Input and Output
A sysadmin checks an 8-character password before rolling it into a corporate policy. The tool shows how quickly the same string falls in different attack modes.
| Input | Output |
|---|---|
qwerty12 (online) | ~2 hours at 1,000 guesses per second |
qwerty12 (offline GPU) | less than 1 second |
Qwerty!2345 (offline GPU) | ~3 years |
Tips for Realistic Estimates
- Always check the offline scenario — stolen hash databases make online rate limits irrelevant.
- Add salt and slow hashing — a bcrypt hash with a high cost factor multiplies the per-guess time by thousands.
- Treat the number as an order of magnitude — hardware improves yearly, so halve the estimate for long-term planning.
- Length is the lever — one extra character multiplies the time by the pool size, which beats any complexity trick.
When to Use This Tool
- Before retiring old credentials — prove a legacy password is crackable in minutes to justify rotation.
- When choosing hashing parameters — see how a cost factor turns a 1-second crack into a 3-year one.
- During security reviews — translate abstract policy rules into time figures stakeholders understand.
The estimate also helps you compare two otherwise similar passwords honestly. A 10-character string with symbols can lose to a 14-character lowercase passphrase once you convert both to time. Run the candidates you are weighing through the tool side by side, and let the offline scenario be the deciding vote, since that is the attack you cannot rate-limit away. Recheck the number whenever hardware or hash settings change, because both move the timeline faster than you might expect.
Frequently Asked Questions
Is the crack time a guarantee?
No, it is a rough estimate based on length, pool, and attack speed. Real attacks also use dictionaries, leaked passwords, and rule sets that can find weak passwords far faster.
What attack speed should I use?
Use the offline GPU scenario for anything sensitive. Attackers who obtain a hash database run billions of guesses per second, which is the worst case you need to survive.
How fast can a GPU crack passwords?
A modern GPU rig tests hundreds of millions of simple hashes per second, so an 8-character lowercase password falls in seconds while a 12-character mixed one takes years.
Does a strong hash change the estimate?
Yes, dramatically. Slow hashes such as bcrypt or scrypt force thousands of rounds per guess, which multiplies the cracking time compared with a fast hash like MD5.
Why does length matter more than symbols?
Every added character multiplies the search space by the pool size. Symbols only increase the pool slightly, while each extra character multiplies the total number of combinations.
Can a dictionary attack beat this estimate?
Yes. The estimate assumes random characters. Passwords built from words, names, or patterns are found by dictionary and rule-based attacks orders of magnitude faster.
How long should a password survive?
For accounts, aim for an offline crack time measured in years or centuries. Anything that falls in minutes under an offline scenario should be rotated immediately.
What is the difference between crack time and entropy?
Entropy measures the search space in bits, while crack time converts that space into a duration using a specific attack speed. Use the Password Entropy tool for the bits, and this one for the timeline.