Password Crack Time Calculator
Estimate how long an attacker might need to guess a password under stated assumptions.
Guided walkthrough
Guided walkthrough
Explore an illustrative brute-force duration.
- Use only the public dummy text DemoOnly123!, never a real credential.
- Compare the displayed length, search-space estimate, and indicative duration. Do not enter a real password for this demonstration.
Illustrative example
Observe the model’s duration for this public text and compare after adding a character; do not interpret it as a survival guarantee.
How to read the result
This simplified model assumes uniformly random choices from detected character groups. It does not account for predictable patterns or leaked passwords. The duration uses 10 billion guesses per second over the full modeled space; it is not a forecast of a real attack.
This is a static educational walkthrough. It does not fill fields, generate values, inspect your browser, or read storage. Use fictitious, non-secret data for practice. Never share passwords, keys, tokens, or cookie values. These explanations are not a security audit or certification.
Share this tool
Only the tool’s public link is shared. Your inputs and results stay here.
Show link to copy manually
Quick answer
Convert a simplified password search-space estimate into an illustrative time using the stated guessing rate. Real cracking time depends on the password, attack type, hardware, and hash protection.
The page and its assets load from the site; this operation uses your entered values only in this browser and does not send them to a calculation endpoint.
How to use it
This page converts a simplified entropy estimate into an illustrative search time at 10 billion guesses per second. Actual cracking time varies with password reuse, known patterns, the target hash and attacker hardware; do not treat the output as a prediction.
Limits
The displayed time uses the stated fixed guessing rate and simplified search model. It does not account for online rate limits, password reuse, common patterns, or the hashing method protecting a stored password.
Frequently asked questions
What guessing rate does the estimate use?
The page states a fixed rate of 10 billion guesses per second. Treat it as an illustrative assumption, not a measurement of a specific attacker.
Does this represent online login attempts?
No. Online services can throttle or block attempts; offline attacks against stolen password verifiers have different constraints.
Why is the displayed time not a prediction?
It estimates time to cover the full simplified search space at the stated rate, not the average time to find a password. Attackers may prioritize common patterns or leaked passwords, and password hashing and hardware can change the rate substantially.
Why can emoji or accented text affect the estimate?
The displayed length counts JavaScript UTF-16 code units, not visible characters, so one emoji may count as two. The model recognizes ASCII letters and digits; every other character is treated as one of 33 possible symbols. Treat the estimate as rough for non-ASCII text.
Sources and references
- NIST Digital Identity Guidelines (SP 800-63B-4, 2025)
- OWASP Password Storage Cheat Sheet
- MDN: String: length
These references document the cited standard or browser API; they do not validate the tool’s output.