Password Entropy & Crack-Time Calculator
Measure true password resistance using Claude Shannon's mathematical information entropy formula. Estimate realistic offline crack times against enterprise 8× RTX 4090 GPU clusters across Windows NTLM, SHA-256, Bcrypt, and Argon2id.
Cryptographic Password Generator
Brute-Force Attack Benchmarks
8x RTX 4090 GPU ClusterCalculates realistic offline dictionary and brute-force cracking durations against modern password-cracking hardware rigs executing Hashcat.
Unsalted or legacy hashes vulnerable to lightning-fast GPU cracking.
Standard cryptographic digests without memory-hard KDF delay loops.
Adaptive CPU-hard hashing algorithm used in modern web backends.
Memory-hard password hashing immune to GPU and ASIC acceleration.
Reserved banner container configured with strict Core Web Vitals CLS = 0 layout preservation.
The Mathematics of Information Entropy: E = L × log₂(R)
Traditional password meters rely on arbitrary checklist heuristics (e.g., "must include one capital letter and one punctuation mark"), which often encourage predictable substitutions like replacing 'a' with '@'.
In modern cryptography, password strength is quantified using Shannon Entropy, measured in bits. The formula calculates the total search space an attacker must traverse:
- E = Total Information Entropy in bits.
- L = Length of the password (number of characters).
- R = Size of the character pool (e.g., 26 for lowercase, 95 for full ASCII).
Each additional bit of entropy doubles the number of combinations an attacker must guess ($2^E$). A password with 60 bits of entropy requires $2^59 \approx 5.76 \times 10^17$ guesses on average.
Why Length Exponentially Outperforms Character Complexity
Because length multiplies logarithmically, increasing password length is far more effective at resisting brute-force attacks than substituting numbers for vowels:
Pool size = 95. Entropy = $10 \times \log_2(95) \approx 65.7$ bits. While decent, predictable substitutions like 0 → o and 4 → a are specifically targeted by Hashcat rule engines, reducing practical entropy to under 40 bits.
Pool size = 27 (lowercase + space). Entropy = $28 \times \log_2(27) \approx 133$ bits. Even if attackers know it consists of 4 dictionary words chosen from a 2,048-word Diceware list, entropy remains $4 \times 11 = 44$ bits, making it thousands of times harder to brute-force than an 8-character symbol soup.
Modern Password Cracking Speeds: NTLM vs. Bcrypt vs. Argon2id
A password does not exist in isolation; its security depends entirely on the algorithm used to store it. An 8× NVIDIA RTX 4090 GPU rig can compute billions of fast cryptographic digests per second, but chokes on memory-hard Key Derivation Functions (KDF):
| Algorithm | 8x RTX 4090 Hash Rate | Memory Hardness | Recommended Use Case |
|---|---|---|---|
| NTLM / MD5 | 100,000,000,000 H/s (100 GH/s) | None (Pure arithmetic) | Deprecated (Legacy Active Directory) |
| SHA-256 / SHA-512 | 15,000,000,000 H/s (15 GH/s) | None | File checksums, digital signatures |
| Bcrypt (Cost 12) | 10,000 H/s (10 kH/s) | 4 KB (Eksblowfish state) | Production web backends |
| Argon2id (64MB RAM) | 500 H/s | 64 MB (Immune to GPU parallelism) | Gold standard (OWASP Recommended) |
Frequently Asked Questions
For online accounts protected by rate limiting and CAPTCHAs, 50–60 bits is generally sufficient. For offline password databases or disk encryption where attackers possess raw hashes, aim for at least 80–100 bits of entropy.
Yes. This utility runs 100% locally in your browser memory via client-side JavaScript. No network requests are sent, no cookies are written, and your inputs are wiped when you close or refresh this tab.
Diceware is a method for generating cryptographically secure passphrases using dice rolls to randomly select words from a numbered wordlist. A 5-word Diceware passphrase provides approximately 64.6 bits of pure, unbiased entropy.
Modern GPUs contain thousands of tiny arithmetic cores capable of executing identical instructions in parallel (SIMD). Algorithms like MD5 or NTLM require simple bitwise math, allowing a single RTX 4090 to test over 20 billion guesses every second.