Brute Force Attack Time Calculator
How Long Would It Actually Take to Guess This Password?
Entropy in bits tells you the size of the search space; this calculator goes one step further and converts that search space into an actual duration, given an assumed guessing speed. The gap between "8 characters" and "12 characters" looks small on a keyboard but represents a difference of years versus geological time once it's run through the math.
The Formula
Time = Keyspace / Guesses per Second
Charset size is the sum of the enabled character classes (26 lowercase, 26 uppercase, 10 digits, 32 symbols); the keyspace grows exponentially with password length, which is why length matters more than character variety once a password passes a reasonable minimum.
Where This Matters
- Setting minimum password length policy — demonstrating why "8 characters minimum" and "12 characters minimum" produce very different real-world security.
- Evaluating attacker capability — comparing a slow, rate-limited online login (thousands of guesses/second at most) against a fast offline hash-cracking rig (billions of guesses/second).
- Security awareness training — giving people a concrete time figure makes "use a longer password" a more persuasive argument than an abstract entropy number.
Estimated Crack Time by Password Configuration
| Password | Guess rate | Estimated time |
|---|---|---|
| 8-char, letters+digits (charset 62) | 1 billion/sec (offline) | ~2.53 days |
| 8-char, letters+digits (charset 62) | 1,000/sec (rate-limited online) | ~6,918.78 years |
| 12-char, all classes (charset 94) | 1 billion/sec (offline) | ~15,081,004.73 years |
| 16-char, all classes (charset 94) | 1 billion/sec (offline) | ~1.177 × 10^15 years |
Computed from Keyspace = Charset^Length and Time = Keyspace / Guess Rate, assuming worst-case exhaustive search with no shortcuts.
How to Use This Calculator
- Enter the Password Length in characters.
- Check the character classes used: lowercase, uppercase, digits, and/or symbols.
- Enter the assumed Guesses per Second the attacker can achieve.
- Select Calculate to get the estimated worst-case time to exhaust the keyspace.
Related Calculations
See the underlying bit count with the Password Entropy Calculator, or apply the same exponential logic to a cryptographic key with the Encryption Key Length Calculator.