Length beats complexity
A long random passphrase usually outperforms a short password with symbols. Use a password manager and unique passwords.
Offline attack estimator · Hive 2026 baseline
Password Cracking Time Calculator
Compare full brute-force time for random passwords across hash types, GPUs, lengths, and character sets.
Attack model
Choose a hash family and hardware profile; the table updates immediately.
Maximum time for a complete brute-force search. Human-chosen passwords can be weaker than the same length suggests.
| Length | 0-9 | a-z | a-z, A-Z | a-z, A-Z, 0-9 | a-z, A-Z, 0-9, symbols |
|---|
> 10 years (Safe)
1–10 years
1 day – 1 year
1 sec – 1 day
< 1 sec (Cracked)
Offline hashes only
The model assumes an attacker already has the hash and can test guesses locally. Online logins behave very differently.
Prefer slow hashes
bcrypt, Argon2id, scrypt, and high-cost PBKDF2 make every guess expensive and change the table dramatically.
How to read the estimate
This calculator models an offline attack where an adversary already has the password hash and can test guesses locally without account lockouts. Select the actual storage algorithm and hardware profile to recalculate the table.
Frequently asked questions
Is this an exact cracking-time prediction?
No. It is an upper estimate for exhaustive search of a random password. Dictionary and rule-based attacks may find human-chosen passwords much sooner.
Can I enter my real password?
No. The calculator intentionally never asks for or transmits passwords; you select only length and character-set assumptions.
Why does the hash type matter?
Fast hashes such as NTLM allow vastly more guesses per second than deliberately expensive bcrypt or Argon2id configurations.