Password Crack Time Calculator

In short How long a password survives depends entirely on where it is attacked. The same password might take centuries against a rate-limited login that allows ten guesses a minute and fall in seconds against an offline attack on a leaked hash with a hundred GPUs, which is why a single "time to crack" figure is meaningless without the attack model beside it. The rows here show that spread deliberately. The measure underneath is entropy in bits: under 40 bits is weak, 60 to 80 is strong for most purposes, and above 80 is very strong against any offline attack currently practical. The important limitation is that entropy assumes RANDOM guessing, and real attacks do not start there. They start with leaked password lists and the substitution rules people actually use, so P@ssw0rd! has far less real-world strength than its character count suggests — it is a dictionary word with predictable substitutions and appears in every cracking wordlist. A four-word passphrase from a random list typically carries 44 to 52 bits, is dramatically easier to remember, and has no dictionary shortcut because the RANDOMNESS is in the word choice. Nothing you type here is sent anywhere; the calculation runs entirely in your browser.