Sources, Assumptions & Calculations — Password Strength Calculator

01 — Core Cracking Time Formula

The calculator models a worst-case offline brute-force attack: an attacker who has stolen a hashed password database and is trying every possible combination locally, limited only by their hardware speed.

keyspace = character_pool_size ^ password_length expected_guesses = keyspace / 2 ↑ 50th percentile — on average the password is found after half the search space has been exhausted time_seconds = expected_guesses / hash_rate_per_second

JavaScript's native BigInt is used for the exponentiation step to avoid floating-point overflow on long passwords (e.g. 30+ chars produce numbers far exceeding Number.MAX_SAFE_INTEGER).

Character Pool Sizing

The pool is determined by scanning the actual characters typed — not by what the user claims to have used. Only classes that appear count toward the pool.

Character class	Characters	Pool contribution	Running total
Lowercase letters	a – z	26	26
Uppercase letters	A – Z	26	52
Digits	0 – 9	10	62
Special / symbols	All printable ASCII not in the above, incl. space !"#$%&'()*+,-./:;<=>?@[\]^_`{\|}~ and space	33	95

Note: 95 is the total count of printable ASCII characters (codes 32–126). Subtracting the 62 alphanumeric characters leaves 33 special characters, which matches the set above.

02 — GPU Hash Rate Benchmarks

All rates come from hashcat benchmarks (hashcat -b), the industry standard tool for measuring offline password-cracking throughput. Community-published results are widely cross-referenced across security research and CTF communities.

Primary Source

hashcat benchmark wiki and community gists — e.g. Chick3nman's RTX 4090 benchmark (GitHub Gist)
NVIDIA published throughput comparisons for A100 vs H100: nvidia.com/h100

RTX 4090 (directly benchmarked)

Algorithm	Rate	Confidence
MD5	164 GH/s	High — widely published hashcat benchmark
SHA-256	22 GH/s	High — widely published hashcat benchmark
bcrypt (cost 10)	24,000 H/s	High — widely published hashcat benchmark

AWS p4d.24xlarge — 8× NVIDIA A100 (extrapolated)

Algorithm	Per-card rate	8-card total	Confidence
MD5	~81 GH/s	648 GH/s	Medium — A100 is ~3–4× RTX 3090; limited public bcrypt data
SHA-256	~9 GH/s	72 GH/s	Medium — extrapolated from FP32 relative throughput
bcrypt (cost 10)	~12,000 H/s	96,000 H/s	Lower — bcrypt is memory-latency bound; fewer public A100 benchmarks exist

xAI Colossus — 100,000× NVIDIA H100 (extrapolated)

Algorithm	Per-card rate	Cluster total	Confidence
MD5	~200 GH/s	20 PH/s	Medium — H100 is ~1.5–3× A100 depending on workload
SHA-256	~20 GH/s	2 PH/s	Medium — extrapolated from NVIDIA H100 spec comparisons
bcrypt (cost 10)	~60,000 H/s	6 GH/s	Lower — bcrypt speedup over A100 is modest due to memory bottleneck

Caveat: A100 and H100 bcrypt rates are extrapolated from architecture comparisons, not from directly observed hashcat -b runs on those GPUs. These GPUs are expensive enough that few researchers publish bcrypt benchmarks for them. The actual rates could be meaningfully higher or lower.

03 — Cost Estimates

Hardware Tiers — Electricity Only

Hardware purchase cost is excluded (the attacker already owns the machine). The running cost is modeled as electricity at the U.S. EIA average residential rate of $0.12/kWh (2024 average; source: U.S. Energy Information Administration).

cost_per_hour = power_draw_watts / 1000 × $0.12

Tier	Assumed draw	Calculation	$/hr
Laptop (integrated GPU)	~50 W	0.050 kW × $0.12	$0.006
Gaming PC (RTX 4090)	~500 W	0.500 kW × $0.12	$0.060
Hacker Rig (8× RTX 4090)	~4,000 W	4.000 kW × $0.12	$0.480

Cloud Tiers — On-Demand Rental

Prices are AWS on-demand rates for US-East-1, as published at aws.amazon.com/ec2/pricing/on-demand/ (early 2025).

Tier	Instance	$/hr	Notes
Cloud Server	1× p4d.24xlarge	$32.77	AWS list price, on-demand
GPU Cluster	100× p4d.24xlarge	$3,277	100 × $32.77; linear scaling. Reserved pricing would be lower.

xAI Colossus — Estimated

xAI's Colossus cluster is not available for public rental. The cost is estimated from spot/on-demand H100 rental prices on the open GPU market:

Market providers (Lambda Labs, CoreWeave, Vast.ai): ~$2.00–$3.50 per H100 per hour as of early 2025
Estimate used: $2.50/H100/hr
Calculation: 100,000 × $2.50 = $250,000/hr

Caveat: The true operating cost of Colossus would also include capital amortization (~$25,000–$40,000 per H100 at 2024 list prices), networking, cooling, and facilities — making the real cost substantially higher. The $250,000/hr figure represents a conservative floor, not a ceiling.

Total Crack Cost Formula

total_cost = cost_per_hour × (time_seconds / 3600)

This is the expected cost at 50th percentile (median attempt). The attacker could get lucky and spend half as much, or unlucky and spend up to twice as much.

04 — Key Assumptions & Limitations

What this calculator assumes

Offline attack only. The attacker has already obtained your hashed password (e.g. from a data breach) and is cracking it locally. Online attacks against a live login form are rate-limited by the server and take orders of magnitude longer.
Uniform random brute force. The attacker tries every combination in the character space systematically. Real attackers often use smarter strategies (see limitations below).
Attacker knows the character set. For example, if your password contains only lowercase letters, the attacker only searches that space. This is a common and reasonable attacker assumption post-breach.
50th percentile (median). On average, a password is found after half the keyspace has been searched. The 100th percentile (worst case for attacker) is exactly double the time shown.
bcrypt cost factor = 10. This is the default in many popular frameworks: Django, Rails, Spring Security, PHP's password_hash(). Cost factor 12 is ~4× slower; cost factor 14 is ~16× slower.
Single GPU type per tier. Real clusters mix hardware generations. The rates shown assume identical GPUs across the tier.

What this calculator does NOT model

Dictionary attacks. Common words, phrases, and patterns (e.g. P@ssw0rd) are cracked almost instantly regardless of what the complexity score shows, because attackers maintain wordlists of billions of known passwords.
Rule-based attacks. Hashcat rules can mutate wordlist entries (capitalize first letter, append a year, replace 'a' with '@') — dramatically extending effective dictionary coverage.
Rainbow tables. Precomputed hash lookups for unsalted algorithms. bcrypt uses per-password salts, making rainbow tables ineffective. MD5/SHA-256 without salting are vulnerable.
Password re-use. If you use the same password on multiple sites and one is breached in plaintext, length and complexity are irrelevant.
Side-channel and social engineering attacks. No amount of password complexity protects against phishing or keyloggers.

Bottom line: The times shown are accurate for random passwords against an attacker doing pure brute force. For passwords made of real words, names, or common substitutions, assume the actual crack time is far shorter than displayed.

05 — Worked Examples

Example A: "cat" — Gaming PC, bcrypt

Pool: 26 (lowercase only) Length: 3 Keyspace: 26³ = 17,576 Expected guesses: 17,576 / 2 = 8,788 Hash rate: 24,000 H/s (RTX 4090, bcrypt cost 10) Time: 8,788 / 24,000 ≈ 0.37 seconds → "< 1 second"

Example B: "Tr0ub4dor&3" — Gaming PC, bcrypt

Pool: 95 (lower + upper + digits + symbols) Length: 11 Keyspace: 95¹¹ = 5.69 × 10²¹ Expected guesses: 2.84 × 10²¹ Hash rate: 24,000 H/s Time: 2.84 × 10²¹ / 24,000 ≈ 1.18 × 10¹⁷ seconds ≈ 3.75 billion years

Example C: "Tr0ub4dor&3" — xAI Colossus, MD5

Pool: 95 Length: 11 Keyspace: 95¹¹ = 5.69 × 10²¹ Expected guesses: 2.84 × 10²¹ Hash rate: 20 × 10¹⁵ H/s (20 PH/s) Time: 2.84 × 10²¹ / 20 × 10¹⁵ ≈ 142,450 seconds ≈ 40 hours Cost: $250,000/hr × (142,450 / 3600) ≈ $9.9 million

Insight: This illustrates why algorithm choice matters enormously. The same password takes billions of years against bcrypt on a gaming PC, but only 40 hours against MD5 on Colossus — a difference of roughly 10¹⁴×. This is why modern systems use slow hashing algorithms.