How long would your password take to guess?
Most estimators assume one guessing speed. In reality the speed depends entirely on how the password is stored on the other end. The same password that falls in seconds against a leaked fast-hash database can hold for centuries if the site used a slow hash like bcrypt. It also checks your sample against the 100,000 most common leaked passwords, because a password on that list is not guessed by brute force at all. Everything runs in your browser and nothing you type is stored. Nothing is sent anywhere unless you press Check Pwned Passwords, which sends only the first five characters of the password's SHA-1 hash.
1qaz2wsx3edc, number 1,473 on the list. Read the analysis and get the data.Time to guess, by how it is stored
Brute force assumes an attacker who knows the character set and tries every combination (average = half the keyspace). Dictionary is the time to reach your sample when the attacker tries leaked passwords in order of popularity, shown when it is on the list.
| Attack scenario | Guesses / sec | Brute force | Dictionary |
|---|
Seven passwords, two answers
The brute-force column is what nearly every crack-time calculator reports, this one included. The dictionary column is what actually happens to a password that is already in circulation: attackers try leaked passwords in order of how common they are, so a password at rank 1,473 falls on guess 1,473 no matter how long or mixed it looks. Both columns assume bcrypt at cost 12 on one RTX 5090, the slowest offline case in the table above.
| Password | Rank on leak list | Estimator says | Brute-force time | Dictionary time |
|---|---|---|---|---|
password | 2 | Weak (38 bits) | 1.4 years | instantly |
trustno1 | 37 | Reasonable (41 bits) | 19 years | under a second |
Password1 | 3,093 | Reasonable (54 bits) | 90 thousand years | 1.3 seconds |
1qaz2wsx3edc | 1,473 | Strong (62 bits) | 32 million years | under a second |
P@ssw0rd | 15,585 | Reasonable (53 bits) | 44 thousand years | 6.5 seconds |
q1w2e3r4t5y6u7i8 | 38,912 | Very strong (83 bits) | longer than the age of the universe | 16 seconds |
nG4#vYq8&Lr2 | not on the list | Strong (79 bits) | longer than the age of the universe | not on the list |
The gap is not a quirk of a few examples: see our analysis of the most common leaked passwords.
Frequently asked questions
How long does it take to crack a bcrypt password?
A single RTX 5090 manages about 2,400 bcrypt guesses per second at cost 12, against more than 200 billion per second for MD5. At that rate a random 10-character password of letters and digits takes millions of years to brute-force; a lowercase-only one, about a thousand years. A password that is already on a leak list still falls in seconds, because it is guessed early.
Does bcrypt stop GPU cracking?
No. bcrypt does not block GPU cracking, it slows it by design. Its deliberate iteration cost turns a seconds-long fast-hash crack into years, but a weak or reused password can still fall.
Why does the same password crack in seconds with MD5 but years with bcrypt?
MD5 and NTLM are fast hashes a GPU computes billions of times per second; bcrypt, scrypt and Argon2 are deliberately slow, cutting the guess rate to thousands per second. The password is identical; the storage method changes the answer by orders of magnitude.
How many bits of entropy is a safe password?
Against an offline attack on a fast hash, aim for 80 bits or more, such as 13 random printable characters or seven words picked at random from a 7,776-word list: one RTX 5090 covers half of a 60-bit space against MD5 in about a month. Against a properly configured slow hash like bcrypt, less entropy is needed because the hash itself supplies the slowdown. None of this applies to a password a person made up, which is guessed from lists and patterns long before brute force.
Is NTLM safe for storing passwords?
No. NTLM is an unsalted fast hash crackable at about 340 billion guesses per second on a single RTX 5090, so every 8-character password can be tried in under a day, and anything on a leak list falls instantly. Use bcrypt, scrypt or Argon2id instead.
What is the difference between an online and offline password attack?
An online attack guesses against a live login and is throttled to a handful of tries per second; an offline attack runs against a stolen hash database at the full speed of the attacker's hardware. Offline attacks are where the choice of hash matters most.
Why do password strength checkers disagree on crack time?
Because each assumes a different attacker and hardware. Online throttling, offline fast-hash cracking and offline bcrypt cracking can differ by more than ten orders of magnitude for the same password.
Guides
- We rated the most common leaked passwords with our own strength meter (original analysis, with data)
- How fast a GPU guesses each password hash (measured on our own hardware, with published RTX 5090 figures)
- How passwords are actually cracked, step by step
- Argon2 vs bcrypt vs scrypt vs PBKDF2: choosing a password hash
- OWASP password-hashing parameters, with a calibrator