Rex says
The fast lane for the math you almost remember from school. Type the numbers, get the answer, move on with your day.
Try a scenario
Click to load — tweak from there.Inputs
Result
Estimated average crack time (years)
754050.24
Entropy
78.7
bits
Average crack time (seconds)
23796015740712.832
Total possible combinations
4.7592031481425665e+23
Character set size
94
Psst — share this and help Rex grow
One click, a permanent link with your numbers baked in.
How to use this
- 1Enter password length.
- 2Enter includes lowercase letters?.
- 3Enter includes uppercase letters?.
- 4Enter includes digits?.
- 5Enter includes symbols?.
- 6Enter storage / attack scenario.
- 7Read your estimated average crack time (years) on the right — it updates as you type.
- 8Hit Share to keep the scenario or send it to someone.
About this calculator
Password strength comes down to entropy: the number of possible combinations, expressed as character set size raised to the password length. A password entropy in bits is log2(character-set-size^length), and crack time is the search space divided by guesses per second, assuming worst-case brute force with no dictionary shortcuts. This calculator computes entropy from your character set choices (lowercase, uppercase, digits, symbols) and length, then estimates crack time against a modern GPU cracking rig doing roughly 10 billion guesses per second for a fast unsalted hash like MD5, versus a properly salted and stretched hash like bcrypt at roughly 10,000-100,000 guesses per second. This is why hashing algorithm choice matters as much as password length: the same 12-character password takes seconds against a fast hash and centuries against bcrypt. Real-world cracking also uses dictionaries, rule-based mutations, and leaked password lists, which cut effective crack time far below the pure brute-force number for common patterns, so entropy calculations are a ceiling, not a guarantee.
Worked example
Using the values the calculator loads with:
Inputs
- Password length: 12
- Includes lowercase letters?: Yes
- Includes uppercase letters?: Yes
- Includes digits?: Yes
- Includes symbols?: Yes
- Storage / attack scenario: Fast unsalted hash (MD5/SHA1) — GPU rig, 10B/sec
Results
- Estimated average crack time (years): 754,050.24
- Entropy: 78.7
- Average crack time (seconds): 23,796,015,740,712.83
- Total possible combinations: 475,920,314,814,256,650,000,000
- Character set size: 94
What each field means
Inputs
- Password length
- The password length used in the calculation. Starts at 12 so you have a working example on load. Accepted range: 1–64.
- Includes lowercase letters?
- Pick the option that matches your situation — the maths changes per option. Choices: Yes, No.
- Includes uppercase letters?
- Pick the option that matches your situation — the maths changes per option. Choices: Yes, No.
- Includes digits?
- Pick the option that matches your situation — the maths changes per option. Choices: Yes, No.
- Includes symbols?
- Pick the option that matches your situation — the maths changes per option. Choices: Yes, No.
- Storage / attack scenario
- Pick the option that matches your situation — the maths changes per option. Choices: Fast unsalted hash (MD5/SHA1) — GPU rig, 10B/sec, SHA-256 unsalted — 1M/sec, bcrypt/scrypt/Argon2, properly configured — 10k/sec, Online login throttled — 100/sec.
Results
- Estimated average crack time (years)
- Returned as a decimal number and shown as the headline result. It recalculates instantly whenever you change an input, so you can compare scenarios without reloading.
- Entropy
- bits
- Average crack time (seconds)
- Returned as a plain value. It recalculates instantly whenever you change an input, so you can compare scenarios without reloading.
- Total possible combinations
- Returned as a plain value. It recalculates instantly whenever you change an input, so you can compare scenarios without reloading.
- Character set size
- Returned as a whole number. It recalculates instantly whenever you change an input, so you can compare scenarios without reloading.
FAQ
Why does the hashing algorithm matter more than password complexity sometimes?
A fast hash like unsalted MD5 lets a modern GPU rig test 10+ billion guesses per second, while bcrypt deliberately slows verification to around 10,000 guesses per second by design. That six-order-of-magnitude difference means a 10-character password on bcrypt can outlast a 16-character password on MD5, which is why choosing a slow, salted hashing algorithm is a bigger security lever than most password policy debates.
Is this calculator's estimate realistic against real attackers?
It's a ceiling for pure brute force with no shortcuts. Real attackers use dictionaries, leaked password databases, and mutation rules (adding numbers, capitalizing first letters) that crack common patterns in minutes even at high entropy, so a random 12-character string is far safer than a 16-character phrase built from dictionary words with predictable substitutions.
What length should I actually require for passwords?
NIST SP 800-63B recommends minimum 8 characters with no forced complexity rules or periodic rotation, instead prioritizing length, breach-list screening, and MFA. For anything protecting sensitive data, 14+ character passphrases or a password manager generating random 16+ character strings is the practical modern standard.
Does adding one more character really matter that much?
Yes, dramatically, because entropy grows exponentially with length. Adding a single character to a 62-character-set password roughly multiplies the search space by 62x, which can turn a crackable-in-hours password into one that takes decades, far more impact than swapping a letter for a symbol.
Accuracy and limitations
- Results are rounded for display; the underlying calculation keeps full precision.
- Very large or very small inputs may hit floating-point limits in the browser.
- Inputs outside the accepted range are clamped rather than rejected.
Related tools
Cite this calculator
Writing about this topic? Grab a citation — every link helps keep these tools free.
RevenueLab. (2026). Password Crack Time Calculator. Retrieved from https://www.revenuelab.fyi/toolbox/password-crack-time
<p>Source: <a href="https://www.revenuelab.fyi/toolbox/password-crack-time" target="_blank" rel="noopener">Password Crack Time Calculator — RevenueLab</a> (2026).</p>
Source: [Password Crack Time Calculator — RevenueLab](https://www.revenuelab.fyi/toolbox/password-crack-time) (2026).