How long would it take to crack my password?

Count the passwords of its shape, the character set's size to the power of its length, and divide by the guesses a second. Eight lowercase letters against bcrypt on one GPU: 253 days to try them all; against MD5, under a second. If your password is a common word or was in a leak, it's guessed early whatever its length.

A random value stored next to each password hash and mixed into it. Two users with the same password get different hashes, so a table computed in advance is useless and each user has to be cracked separately. NIST requires a salt of at least 32 bits; the stage uses 128.

Is a long password better than a complex one?

Length grows the search fastest: 15 lowercase letters make about 250,000 times as many passwords as 8 characters drawn from all 95 printable ones. NIST's SP 800-63B now tells sites not to impose composition rules, and to require at least 15 characters for a password used without a second factor.

How do hashed passwords still get cracked?

Some sites use fast hashes, which a GPU guesses billions of times a second. And a password that's common or already leaked is guessed early whatever the hash, as sunshine is on the stage after six guesses. A slow, salted hash makes each guess expensive; it can't make a guessable password safe.

Should sites use bcrypt or Argon2?

OWASP recommends Argon2id first, at 19 MiB of memory, 2 iterations and 1 degree of parallelism or an equivalent setting, then scrypt. It suggests bcrypt, at cost 10 or more, only for legacy systems where Argon2 and scrypt aren't available, and lists PBKDF2-HMAC-SHA256 at 600,000 iterations.

Live model · Password cracking

How Password Cracking Actually Works

A site should never store your password, only a salted, slow hash of it. To crack it after a leak, an attacker hashes guesses until one matches. How long that takes is the number of possible passwords divided by guesses per second, and the hash sets the rate: billions a second for MD5, thousands for bcrypt.

Every password of one shape, four hashes

Brute force tries every password of one shape. Against bcrypt at cost 10, one RTX 5090 makes 9,525 guesses a second; the table has the other hashes.

StopBrute force

LengthCharactersStored withGPUs

Passwords·Guesses a second9,525

Time to try every password of lowercase letters

MD5
SHA-256
PBKDF2
bcrypt

One RTX 5090's guesses a second

Hash	Guesses/s	Time
MD5	220.6 billion	·
SHA-256	28.4 billion	·
PBKDF2	18,577	·
bcrypt	9,525	·

PBKDF2-HMAC-SHA256 at 600,000 iterations, bcrypt at cost 10

Watch the Python behind this model run, line by line

How to read the stage

Each step adds a character. The chart's four lines are the time to try every password of that length against four hashes on one RTX 5090, as powers of 10 seconds. Eight lowercase letters make 208,827,064,576 passwords: under a second against MD5, 253 days against bcrypt. Hive Systems' 2026 table assumes 16 RTX 5090s on bcrypt and says 2 weeks for that shape; set 16 GPUs and the stage gives 15 days.

Why slow hashes

OWASP calls fast hashes like SHA-256 unsuitable for passwords because they let attackers guess quickly. Its settings make each guess expensive instead: Argon2id with at least 19 MiB of memory, PBKDF2-HMAC-SHA256 at 600,000 iterations, or bcrypt at cost 10 or more. In a hashcat benchmark, one RTX 5090 makes 220.6 billion MD5 guesses a second, and about 9,500 at bcrypt cost 10, scaled from its cost-5 run.

Why every password gets a salt

Below, Ana and Ben both pick sunshine. Stored as plain SHA-256, their rows match, and a table of hashes made in advance names the password without hashing anything new. With a random salt each and PBKDF2 at 1,000 iterations, the rows differ and the table finds nothing. Cracking Ana takes 6 guesses, 6,000 HMACs, and Ben's different salt makes the attacker pay again: 12,000 in all.

Two users, one password, two ways to store it

Ana and Ben sign up to the same site, and both pick the password “sunshine”. The site must store something it can check a login against.

StopStoring a password

Both users pickPBKDF2 iterationsSalt seed

User	Salt	Stored hash	Cracked
ana	·	·	·
ben	·	·	·

Guess	Hash with the salt	Match
(none)

CH1 identical rows

Watch the Python behind this model run, line by line

What the model leaves out

Times are for trying every password of a shape; on average the right one turns up halfway. They assume a random password. People don't pick at random, so attackers try common and leaked passwords first, and NIST requires sites to block those. The rates come from one benchmark, scaled to the settings sites use; Hive measured 138,675 bcrypt guesses a second on its 16 GPUs, a little under the stage's figure.

Questions

How long would it take to crack my password?: Count the passwords of its shape, the character set's size to the power of its length, and divide by the guesses a second. Eight lowercase letters against bcrypt on one GPU: 253 days to try them all; against MD5, under a second. If your password is a common word or was in a leak, it's guessed early whatever its length.
What is a salt?: A random value stored next to each password hash and mixed into it. Two users with the same password get different hashes, so a table computed in advance is useless and each user has to be cracked separately. NIST requires a salt of at least 32 bits; the stage uses 128.
Is a long password better than a complex one?: Length grows the search fastest: 15 lowercase letters make about 250,000 times as many passwords as 8 characters drawn from all 95 printable ones. NIST's SP 800-63B now tells sites not to impose composition rules, and to require at least 15 characters for a password used without a second factor.
How do hashed passwords still get cracked?: Some sites use fast hashes, which a GPU guesses billions of times a second. And a password that's common or already leaked is guessed early whatever the hash, as sunshine is on the stage after six guesses. A slow, salted hash makes each guess expensive; it can't make a guessable password safe.
Should sites use bcrypt or Argon2?: OWASP recommends Argon2id first, at 19 MiB of memory, 2 iterations and 1 degree of parallelism or an equivalent setting, then scrypt. It suggests bcrypt, at cost 10 or more, only for legacy systems where Argon2 and scrypt aren't available, and lists PBKDF2-HMAC-SHA256 at 600,000 iterations.