FREE SECURITY TOOLS
See exactly how long it would take to crack your password under different attack scenarios.
Password strength isn't just about how complex a password looks — it's about how long it takes an attacker to guess it. The scenarios below represent real-world attack conditions, from a slow online login form all the way to the theoretical maximum of nation-state cracking hardware. Seeing your password's resistance to each helps you make an informed decision about whether it's strong enough for the account it protects.
The most critical scenario for most people is the offline GPU cluster row. If your password has ever been part of a data breach, an attacker could be cracking it right now on hardware that makes billions of guesses per second — with no rate limiting. That's why passwords that seem strong to humans can be cracked in hours.
Your password is never sent anywhere — all analysis happens in your browser.
Enter a password above to see crack time estimates
🌐 Online attack (rate-limited)
The slowest scenario — a real login form on a website. Most services throttle to 10–100 attempts per second and lock accounts after several failures. An 8-character password is still safe here — but that's a false sense of security if the same password is used elsewhere.
💻 Offline MD5 / ⚡ GPU cluster SHA-256
These scenarios apply when an attacker has already stolen a password hash database. With no rate limiting, a modern GPU can attempt billions of hashes per second. MD5 hashes are especially vulnerable — they were never designed for password storage. If a site stores MD5 passwords and gets breached, your password could be cracked in seconds.
🔐 Offline bcrypt (cost 12)
Bcrypt is designed to be slow. At cost 12, a GPU can only attempt around 10,000 guesses per second — a ~100,000× reduction from MD5. This is why services like Dropbox and GitHub use bcrypt: even if their database is stolen, attackers can only make a tiny fraction of the guesses per second.
🏛️ Nation-state hardware
A theoretical upper bound representing custom ASIC hardware operated by a nation-state actor. This scenario is primarily relevant for high-value targets. For most users, the GPU cluster scenario is the practical worst case to design against.