Length beats complexity
A long random passphrase usually outperforms a short password with symbols. Use a password manager and unique passwords.
Windows scenario · NTLM
NTLM Password Cracking Calculator
Estimate exhaustive NTLM search on one RTX 5090, then compare other GPUs or cluster sizes.
Attack model
Choose a hash family and hardware profile; the table updates immediately.
Maximum time for a complete brute-force search. Human-chosen passwords can be weaker than the same length suggests.
| Length | 0-9 | a-z | a-z, A-Z | a-z, A-Z, 0-9 | a-z, A-Z, 0-9, symbols |
|---|
> 10 years (Safe)
1–10 years
1 day – 1 year
1 sec – 1 day
< 1 sec (Cracked)
Offline hashes only
The model assumes an attacker already has the hash and can test guesses locally. Online logins behave very differently.
Prefer slow hashes
bcrypt, Argon2id, scrypt, and high-cost PBKDF2 make every guess expensive and change the table dramatically.
How to read the estimate
NTLM is a fast hash without built-in salting or an adjustable work factor, so GPUs can test enormous numbers of guesses per second. The preset uses one RTX 5090 and lengths 6–16.
Frequently asked questions
Why is NTLM so fast to brute-force?
It was not designed as a modern slow password-storage function and maps efficiently to massively parallel GPU workloads.
Does this model an online Windows login?
No. It models offline search after an attacker has already obtained the NTLM hash.
Does a long passphrase help?
Yes for random values: length expands the keyspace exponentially, although human phrases may still be vulnerable to dictionaries.