Password Crack Time Calculator

It models a worst-case brute-force search over the whole keyspace. The pool size is the sum of the character classes you select (lowercase 26, uppercase 26, digits 10, symbols 32, space 1), the keyspace is pool size raised to the password length, and the average attacker finds the password after trying half of it. Dividing that half-keyspace by a guess rate gives the time to crack at that rate.

The calculator offers five planning rates: 10, 1,000, 10,000, 10 billion, and 1 trillion guesses per second. They illustrate how quickly estimates change across very different attack conditions. Actual online rates depend on rate limits, MFA, lockouts, and monitoring. Actual offline rates depend on the algorithm parameters, hardware, salt, and attack, so do not treat a preset as a bcrypt or Argon2 benchmark.

Length multiplies the exponent while the character set only changes the base. Entropy equals length times the base-2 logarithm of the pool size, so each extra character adds a fixed number of bits, but going from 12 to 16 characters adds four whole multiples of that gain. A long all-lowercase passphrase often beats a short password that mixes every character class.

They are an upper bound, not a prediction. The math assumes a random password with no structure, so a real attacker who tries dictionary words, names, dates, keyboard walks, and common substitutions first will crack a human-chosen password far faster than the worst-case numbers shown. Treat the result as the best case for you and the worst case for the attacker.

The label comes from the calculator's entropy bands: under 28 bits is very weak, 28 to 49 is weak, 50 to 79 is fair, 80 to 127 is strong, and 128 or more is very strong. These are model labels, not NIST requirements. Real password strength also depends on rate limiting, breach-resistant storage, and whether the password is truly random. Use a password manager for long, unique passwords.