Password Crack Time Calculator and Entropy Checker

Test a password: entropy in bits, brute-force crack time on GPUs (including an RTX 4090) and a passphrase generator worth about 86 bits.

Password cracking time: the formula and its assumptions

Brute-force cracking time is the number of combinations (alphabet size to the power of length) divided by guesses per second. The tool searches the whole space at two assumed rates, 10 billion and 100 trillion guesses per second: an 8-character password mixing all 4 character types lasts about 8 days in the first case and one minute in the second. It also shows an average time for a fast hash (MD5, NTLM) attacked by one or eight RTX 4090 cards.

Calculation

The alphabet counts 26 lowercase letters, 26 uppercase, 10 digits and 33 symbols, each group added as soon as one character of that type appears (a space or an accented letter counts as a symbol). Entropy = length × log2(alphabet), rounded to the bit. Time = alphabet^length ÷ rate, over the entire space.

Worked examples

  • Paris2024: 9 characters, alphabet of 62, 54 bits. 62^9 = 1.35 × 10^16 combinations: 16 days at 10 billion guesses per second, 2 minutes at 100 trillion.
  • motdepasse: 47 bits, 4 hours at the first rate. A dictionary attack would find it much sooner; the tool does not spot common words.
  • K3ep$ecure2026! (default): 15 characters, alphabet of 95, 99 bits, rated ultra secure.

Assumptions and limits

  • All these rates are the tool's assumptions. The real rate depends mainly on the hash function: a slow hash (bcrypt, scrypt, Argon2) cuts it by several orders of magnitude compared with MD5 or NTLM.
  • The formula overrates words and patterns: guitare-pomme-navire-nuage shows 153 bits, whereas 4 words drawn at random from a 7,776-word list give only 51.7.
  • Display: in years up to 999 years, then in thousands and millions of years, rounded; beyond a billion years, several billion years. 12 characters mixing all 4 types take 1.7 million years at the first rate, shown as 2 million years.
  • Levels: above 80 bits ultra secure, above 60 strong, above 40 medium.

The RTX 4090 cards give shorter times for the same password because they count half the space on average, at 100 or 800 billion hashes per second. For Paris2024, one card needs 18.8 hours instead of 16 days. The tool's tip suggests at least 4 random words; the French data protection authority (CNIL) uses 7.

Sources and dates: CNIL deliberation no. 2022-100 of 21 July 2022: at least 80 bits for a password used alone; NIST SP 800-63B-4, final version of July 2025: at least 15 characters for single-factor use, 8 with multi-factor; ANSSI guide on multi-factor authentication and passwords, published 8 October 2021 (checked 14/10/2026).

Frequently Asked Questions

How long does it take to crack an 8-character password?

With lowercase, uppercase, digits and symbols there are 95^8, or 6.6 × 10^15, combinations. The tool shows 8 days at 10 billion guesses per second and one minute at 100 trillion. These rates are assumptions: a slow hash such as bcrypt stretches the times considerably.

How is password entropy calculated?

Multiply the length by the base-2 logarithm of the alphabet size. A 12-character password drawn from 95 possible symbols reaches 78.8 bits, a 14-character alphanumeric one 83.4 bits. The calculation assumes characters chosen at random.

Why does a passphrase show such high entropy?

The tool treats each letter as an independent draw, which overrates words. guitare-pomme-navire-nuage shows 153 bits, whereas 4 words drawn at random from a 7,776-word list are worth 51.7 bits. Count about 12.9 bits per truly random word instead.

What password length do the CNIL and NIST recommend?

The French CNIL requires 80 bits of entropy for a password used alone, for example 12 characters mixing all 4 types or a 7-word passphrase (deliberation of 21 July 2022). NIST requires at least 15 characters for single-factor use and 8 with a second factor (SP 800-63B-4, July 2025). NIST also forbids imposing composition rules.

Why does the tool show two sets of crack times?

The first two figures cover the whole space of combinations, at 10 billion and then 100 trillion guesses per second. The RTX 4090 cards give an average time, over half of the combinations, for a fast hash such as MD5 or NTLM: 100 billion hashes per second for one card, 800 billion for eight. For Paris2024, that means 16 days in the first case and 18.8 hours with a single RTX 4090.

Is the passphrase generated by the tool safe?

Yes. The button draws 4 words of 3 syllables, each syllable out of 100, plus a number from 10 to 99, using the browser's cryptographic generator: 9 × 10^25 combinations, or 86.2 bits, which the tool rounds to 86. That is above the 80 bits set by France's CNIL. As long as you leave the phrase unchanged, the times shown are based on that draw; after any edit, the tool goes back to the character-set estimate.

Is this tool really free?

Yes, all tools on Kristools are 100% free and accessible without registration.

Is my data protected?

Yes. All processing is performed directly and securely inside your browser. No personal data is sent to our servers.