Which matters more: password length or hash algorithm?

Hash algorithm dominates by orders of magnitude. bcrypt at cost 12 on an 8-character password with 50 bits of entropy takes ~400 centuries to crack on an RTX 4090. Unsalted SHA-256 on a 20-character password with 130 bits of entropy takes ~3 days on the same hardware. The hash function restricts the attacker's rate of guesses; password length only determines how many guesses they need. Always choose bcrypt, Argon2, or scrypt before worrying about password length.

How many hashes per second can an RTX 4090 compute?

For NTLM (Windows): ~300 GH/s (300 billion hashes/second). For SHA-256: ~22 GH/s. For bcrypt cost 5: ~150 kH/s. For bcrypt cost 12: ~3 kH/s (3,000 hashes/second). For bcrypt cost 14: ~700 H/s. This 9-order-of-magnitude range is why hash algorithm selection matters far more than password complexity.

How long should my password be?

With a strong hash function (bcrypt cost 12+, Argon2id), a randomly-generated 12-character password from a full 94-character printable ASCII set provides ~78 bits of entropy, which is effectively uncrackable (~10^10 years on 8×A100). Even 10 random characters (~65 bits, ~800,000 years) is sufficient. The real risk is password reuse and credential stuffing, not brute force — use a password manager and unique passwords everywhere.

Password Crack Time Estimator — Hash Speed Calculator

🔐 Password Configuration

Set password length, character sets, hash algorithm, and attacker hardware tier. Never enter a real password. The engine computes keyspace, entropy, and crack time from consumer GPU to nation-state ASIC farm.

Password Length

Hash Algorithm

Attacker Hardware

Character Sets Used

Lowercase (a-z) Uppercase (A-Z) Digits (0-9) Symbols (!@#$%^&*)

Password Entropy: The Only Metric That Matters

Password strength is measured in entropy bits — the logarithm (base 2) of the total keyspace. A password chosen from a 62-character set (a-z, A-Z, 0-9) at length 8 has 62⁸ ≈ 2.18 × 10¹⁴ possible combinations, or about 47.6 bits of entropy. At a modern GPU hash rate of 300 GH/s for NTLM, this keyspace is exhausted in roughly 12 minutes. Increase the length to 12 characters and the same character set yields 62¹² ≈ 3.23 × 10²¹ combinations — 71.5 bits of entropy — which takes the same GPU over 340,000 years.

Hash Algorithm Matters More Than Length

The choice of hash algorithm is the single largest factor in real-world crack resistance. NTLM (Windows) can be attacked at 300+ GH/s on a single RTX 4090. SHA-256 drops to ~2.8 GH/s. bcrypt (cost factor 12) drops to ~5 kH/s — sixty million times slower than NTLM. An 8-character password that falls in minutes under NTLM may survive years under bcrypt. Always store passwords with bcrypt, scrypt, or Argon2id — never with general-purpose hash functions.

The Attacker Gets Faster Every Year

Moore's Law applied to password cracking: hash rates approximately double every 18-24 months. A password that takes 10 years to crack today may take only 2 years in 2030. The NIST SP 800-63B guidelines recommend a minimum of 8 characters for user-chosen passwords and 6 characters for randomly generated ones, but practical defense requires 12+ characters with a slow hash — giving a margin of safety that survives hardware improvement curves for decades.

Password Crack Time Estimator

🔐 Password Configuration

🔓 Attack Simulation Results

Attack Scenarios

Password Entropy: The Only Metric That Matters

Hash Algorithm Matters More Than Length

The Attacker Gets Faster Every Year

🔐 Password Configuration

🔓 Attack Simulation Results

Attack Scenarios

Password Entropy: The Only Metric That Matters

Hash Algorithm Matters More Than Length

The Attacker Gets Faster Every Year

📰 Related Research

Related Tools