About crack-time.tools
crack-time.tools estimates how long a password resists guessing, and makes the point most estimators skip: the answer depends on how the site stores the password and on whether the password is already on an attacker's list, not just on its length.
Original research on the site
- We rated the most common leaked passwords with our own strength meter: 755,994 passwords from a public leak list, scored with this site's estimator, with the scripts and data published.
- How fast a GPU guesses each password hash: hashcat measurements on our own hardware at OWASP's settings, beside the published RTX 5090 benchmark, with the raw method and its checks.
Tools and guides
- Crack-time estimator: brute-force and dictionary time for a sample password across fast and slow hashes, with a check against the most common leaked passwords.
- Hashing parameters: OWASP's recommended settings for Argon2id, scrypt, bcrypt and PBKDF2 with our measured attack speed for each, and a PBKDF2 calibrator for your own machine.
- How passwords are cracked and choosing a password hash.
The estimator runs in your browser. Use a sample, not a password you actually use. Nothing you type is sent anywhere unless you choose the optional Pwned Passwords check, which sends only a five-character hash prefix; the privacy policy has the details.
Who makes it
crack-time.tools is one of a small family of free security reference tools (the others are linked in the footer and collected at sec-ref.tools). They are built and maintained by a working security researcher who uses them day to day, because the generic calculators for these tasks are often out of date, cluttered, or wrong, and a good reference tool should not require an account.
Accuracy
Care is taken to keep the reference data correct, but these tools are provided for general information and estimation. For anything that matters, verify against the primary standard or data source, each of which is linked from the relevant tool. See the Terms for the full disclaimer.
Contact
Corrections, bug reports and suggestions are welcome. Email contact@sec-ref.tools, or see the contact page.