Turn password entropy and an attack rate into an estimated time to crack, from instant to billions of years.
Bits of entropy in the password or keyspace (see a password entropy calculator). Unit: bits.
How many guesses the attacker can test per second. Unit: guesses/s.
Estimated Crack Time
4.9 hours
Estimated Crack Time — Calculated outcome. Derived from your inputs via the displayed formula; use to plan.
Seconds
17,592
Seconds — Calculated outcome. Derived from your inputs via the displayed formula; use to plan.
Minutes
293.20
Minutes — Calculated outcome. Derived from your inputs via the displayed formula; use to plan.
Hours
4.89
Hours — Calculated outcome. Derived from your inputs via the displayed formula; use to plan.
Days
0.20
Days — Calculated outcome. Derived from your inputs via the displayed formula; use to plan.
Years
0.00
Years — Calculated outcome. Derived from your inputs via the displayed formula; use to plan.
What this means
A keyspace of N bits holds 2^N possible values. In the worst case the attacker has to try all of them, so the total guesses is 2^N. Dividing by the guesses-per-second rate gives the time in seconds, which is then converted into days and years. Real-world attacks are faster on average (half the space is enough), so t...
Brute-force cracking is simply guessing until you hit the right value. How long that takes depends on the size of the search space (2^entropy) and how fast the attacker can test guesses. This tool combines those two numbers into a single time-to-crack estimate.
Formula
time = 2^entropyBits ÷ attackerRate
Worked examples
FAQ
What is a "safe" number of entropy bits?
For online guessing, roughly 50+ bits is workable; for offline hashes with fast hashing, security guidance commonly calls for 80+ bits of entropy.
Why is my result larger than a password checker reported?
Password strength meters usually estimate entropy from the password; this tool only converts entropy bits plus a rate into time, so feed it the bits value you want to test.