Crack-Time Estimator
See how long a password would survive a real attack — and why patterns cut it short.
Never paste a production secret into any website, including this one. Test with a password of the same shape instead.
How this works
The tool works out the password’s effective entropy, reducing it for the patterns cracking software tries first — dictionary words, keyboard runs, a word followed by numbers. It then converts that into an estimated time to crack at three realistic attack speeds, from a rate-limited login to a GPU rig against a fast hash.
What the results mean
- Offline, fast hash on GPUs
- The worst realistic case: your password database was stolen and hashed with something fast like MD5. This is the number worth designing against.
- Offline, bcrypt
- A well-built site that was breached. Deliberately slow hashing buys enormous time even for modest passwords.
- Online attack
- Guessing against a live login that limits attempts. Almost any password survives this, so it is the least useful figure.
Common problems and fixes
- My clever password scores as instantly crackable
- Substitutions like P@ssw0rd add nothing — every cracking ruleset applies them automatically. The tool reflects that, which is exactly what makes it useful.
- A boring long passphrase beats my complex one
- Correct and intentional. Length beats complexity, because each extra random word multiplies the search space more than a symbol does.
Frequently asked questions
Which crack time should I care about?
The GPU-against-a-fast-hash figure. It is the worst realistic case, and if a password survives that comfortably, it survives everything easier. The online-attack figure is reassuring but assumes an attacker who cannot steal the database, which is the scenario you least control.
Is it safe to type my real password here?
The page makes no network request and blocks outbound connections via its Content-Security-Policy, so technically nothing leaves. But the safer habit is to test a password of the same shape rather than the real one, on any site.