How Long Would Your Password Survive?
Type a password below. See exactly how long it would take to crack — from a throttled login form, to a gaming PC, to a nation-state supercomputer. Based on real Hashcat benchmarks.
correct-horse-battery-staple) give 50+ bits of entropy and you'll actually remember it.▸ Methodology & Honesty Note
Hash rates are based on public Hashcat benchmarks for MD5 — a common "worst case" scenario where a site stores passwords using fast, unsalted hashing. A single RTX 4090 hits roughly 164 GH/s on MD5; an 8-GPU rig scales that to ~1.3 TH/s. These are real numbers, not guesses.
If the target uses proper hashing (bcrypt, Argon2, scrypt with high cost factors), crack times are orders of magnitude longer — but you don't get to choose how the services you use hash your password. Assume the worst.
Online attack tiers (10/s throttled, 1,000/s unthrottled) model credential stuffing and login-form brute-forcing against services with varying rate-limit defences.
Entropy calculation uses length × log₂(charset) with penalties for common passwords, keyboard patterns, sequential characters, repetition, and year suffixes. A match in our common-password list drops the effective entropy dramatically — real attackers always try dictionary first.
Privacy: This page has no analytics or fetch calls tied to your input. Your password is processed in JavaScript inside your browser tab and discarded when you close it. You can verify this yourself by opening DevTools → Network.