Brute Force Time Estimator – Password Crack Time Calculator

Password strength is length times complexity. That’s what you think, anyway. You think that swapping an ‘a’ for a ‘4’ makes your password secure or that adding punctuation are a smart move.

But length trumps everything else; it’s the greatest factor in formula. If the key space isn’t too large to exhaustively scan, your sofisticated substitution doesn’t matter because… well, there aren’t many ways to spell “password.”

Why Long Passwords Are Best

The calculator here boil your secret down to a basic math question. Give it two details about your password and one detail about your adversary, and it’ll tell you how long it will take to find the right password. That’s a function of what mathematicians call the keyspace: the number of possible combinations which is alphabet size times the number of positions. There are ten choices if it’s digits and 26 choices if its lowercase letters. Adding symbols and uppercase letters grow your pool. Then, adding more characters increase the total number of combinations by multiplying it by the size of the alphabet. That means length wins every single time, with each additional character making the password exponentially harder. It goes from being something people can manage (10 alnum) to astronomically difficult (12 alnum). And it does that math for you, here’s how fast it ramps up:

That leaves the question of how long it would take (the answer: not very). An attacker isn’t likely to attempt each possible combination; instead, he’d be able to narrow it down quickly to half of the keyspace on average. That’s the difference between worst- and average-case time. The estimator take both into account. The former is more like a theoretical upper-bound, which is useful to understand scale but probably never what an attack actualy looks like. The latter is expected amount of effort, making it important for practical risk assessment.

But the game changes when you look at hardware. Rate limiting an attacker to one thousand guesses per second might seem slow, but its fast enough to crack short PINs using something as simple as a login form. That’s still pretty quick: it can still take minutes to crack short PINs (credentials which are frequently leaked in data breaches). And there, the attacker goes offline, pulling out their GPU rigs which can test billions of hashes per second. An online attack on a fast hash like MD5 takes hours; an offline attack on the same hash take seconds. That’s why it’s important to choose a slow hashing algorithm like bcrypt: it deliberately slows down the guess rate, forcing even a powerful computer to crawl along.

But there’s yet another level of risk: attacks can happen on multiple machines at once. Because attackers are renting out clusters of servers, or using their own network of computers. This increase the danger. There’s field for parallel machines on the calculator, because every time you double up the hardware you cut the time in half. What could take days for a single laptop may fall in days with a fleet of servers and who wants your data? What kind of resources do they have?

In summary, the connection between these three things can be summarized on the output cards which display the keyspace (in scientific notation since the numbers get big) as well as the average time to crack (converted into human readable units such as centuries/years/hours). If it takes centuries to crack something, it is beyond what any rational attacker would spend their money on; so, if your password achieves that, you’re good. The last card display how many guesses per second it will go through (after taking into account parallel machines), giving you some real clarity as to why a given password is weak or not.

The tool models real-world examples with presets so you can visualize how quickly a six-digit PIN dissapears before a GPU’s eyes, while lasting longer when attacked by a throttled one. It also compares a fourteen-character mix of numbers and letters to an eight-character lowercase string, showing how unproductive it is to increase complexity without also increasing the character count. A set of common words used as a randomly generated passphrase can be extremely secure: The list becomes a big alphabet, and each word contribute a lot of entropy without needing to be memorable enough for you to memorize any symbols.

So brute force time is ultimately an economic decision: If it takes longer for me to crack someone’s password then the value of their data, I’ve lost. But the tool turns abstract security notions into a real deadline. Run your passwords through it and see how you fare; maybe you’ll discover that four extra randomly chosen characters increase your margin of safety from years to centuries. That kind of exponential growth work in your favor.