Password Crack Time Calculator

It models a worst-case brute-force search over the whole keyspace. The pool size is the sum of the character classes you select (lowercase 26, uppercase 26, digits 10, symbols 32, space 1), the keyspace is pool size raised to the password length, and the average attacker finds the password after trying half of it. Dividing that half-keyspace by a guess rate gives the time to crack at that rate.

Five order-of-magnitude rates: 10 guesses per second for a rate-limited login, 1,000 per second for an online endpoint with no throttle, 10,000 per second for stolen hashes behind a slow algorithm like bcrypt or Argon2, 10 billion per second for fast unsalted hashes (MD5 or SHA-1) on a single high-end GPU, and 1 trillion per second for a GPU or ASIC array. Brute-force time spans many orders of magnitude, so the exponent of the rate matters far more than the exact figure.

Length multiplies the exponent while the character set only changes the base. Entropy equals length times the base-2 logarithm of the pool size, so each extra character adds a fixed number of bits, but going from 12 to 16 characters adds four whole multiples of that gain. A long all-lowercase passphrase often beats a short password that mixes every character class.

They are an upper bound, not a prediction. The math assumes a random password with no structure, so a real attacker who tries dictionary words, names, dates, keyboard walks, and common substitutions first will crack a human-chosen password far faster than the worst-case numbers shown. Treat the result as the best case for you and the worst case for the attacker.

The label comes from entropy bits: under 28 bits is very weak, 28 to 49 is weak, 50 to 79 is fair, 80 to 127 is strong, and 128 or more is very strong. NIST SP 800-63B treats 80 bits as a sensible floor for high-value accounts, which a 16-character password using letters and digits clears comfortably. Use a password manager so you can afford long, random entries you never need to memorize.