Brute-Force Crack Time Calculator
Estimate how long an attacker needs to brute-force a password from its length, character set and the guessing speed of the attack.
How it works
combinations = charset ^ length · entropy bits = length × log₂(charset) · average time = (combinations ÷ 2) ÷ guesses per second
Brute forcing tries every possible string until one matches, so the total effort is the size of the character set raised to the length of the password. On average an attacker finds the answer after searching half of that keyspace, which is why the expected time is the combination count divided by two, then divided by how many guesses the hardware can make each second. Each extra character multiplies the work by the full charset size, so length buys far more security than swapping a letter for a symbol.
Worked example
A 12-character password drawn from 62 symbols (letters and digits) has 62¹² ≈ 3.2×10²¹ combinations, about 71.5 bits. At 10 billion guesses per second, half the keyspace is 1.6×10²¹ tries — roughly 5,100 years.
Sources: Password strength — Wikipedia
Frequently asked questions
Why divide the combinations by two?
Because an attacker rarely searches the entire keyspace — on average the correct password is found after checking half of the possibilities, so expected time uses combinations ÷ 2. The worst case (the last string tried) is shown separately.
What guessing speed should I use?
It depends on the hash. A slow, salted hash like bcrypt may allow only thousands of guesses per second, while a fast unsalted MD5 on a GPU cluster can reach hundreds of billions. Pick a speed that matches the threat you are modelling.
Does adding one character really matter that much?
Yes. Each additional character multiplies the keyspace by the full character-set size — one more symbol from a 62-set makes the password 62× harder to crack, far outweighing most other tweaks.
Related calculators
This calculator is for educational purposes. Double-check important results before acting on them.