What this calculator does
The Password Crack Time Calculator estimates how long an attacker would need to brute-force a password by trying every possible combination. It is based purely on the size of the keyspace and the attacker's guessing speed, giving you a quick sense of how much stronger a longer or more complex password really is.
How to use it
Enter the password length (number of characters), tick the character sets your password draws from, and set the attacker's guesses per second. A modern GPU rig can do roughly one billion (1,000,000,000) fast-hash guesses per second, which is a reasonable default. The result shows the worst-case time to exhaust the entire keyspace, expressed in seconds, hours, days, and years.
The formula explained
The total number of possible passwords is the character set size raised to the power of the length: \(C = N^{L}\). Dividing that by the attacker's guesses per second gives the time to try them all:
$$t = \frac{N^{L}}{G}$$The character set size N adds up: lowercase (26), uppercase (26), digits (10) and symbols (32), so a full mix gives \(N = 94\).
Worked example
Take an 8-character lowercase password (\(N = 26\), \(L = 8\)) against an attacker doing 1 billion guesses/second. Combinations = \(26^{8} = 208{,}827{,}064{,}576\). Crack time:
$$t = \frac{208{,}827{,}064{,}576}{1{,}000{,}000{,}000} \approx 208.83 \text{ seconds}$$— under four minutes. Add uppercase, digits, and symbols (\(N = 94\)) and the same length jumps to \(94^{8} \approx 6.1 \times 10^{15}\) combinations, or about 70 days.
FAQ
Is this exact? No. It is the theoretical maximum for pure brute force. Real attackers use dictionaries, leaked password lists, and patterns, so a guessable password falls far faster than this estimate.
What guess rate should I use? It depends on the hash. Fast hashes (MD5, unsalted) allow billions per second; slow hashes (bcrypt, Argon2) allow only thousands. Lower G means a much longer crack time.
How do I make a strong password? Length beats complexity. Each extra character multiplies the keyspace by N, so a long passphrase is dramatically harder to crack than a short complex one.
