Sources, Assumptions & Calculations — Password Strength Calculator

01 — Core Cracking Time Formula

The calculator models a worst-case offline brute-force attack: an attacker who has stolen a hashed password database and is trying every possible combination locally, limited only by their hardware speed.

keyspace = character_pool_size ^ password_length expected_guesses = keyspace / 2 ↑ 50th percentile — on average the password is found after half the search space has been exhausted time_seconds = expected_guesses / hash_rate_per_second

JavaScript's native BigInt is used for the exponentiation step to avoid floating-point overflow on long passwords (e.g. 30+ chars produce numbers far exceeding Number.MAX_SAFE_INTEGER).

Character Pool Sizing

The pool is determined by scanning the actual characters typed — not by what the user claims to have used. Only classes that appear count toward the pool.

Character class	Characters	Pool contribution	Running total
Lowercase letters	a – z	26	26
Uppercase letters	A – Z	26	52
Digits	0 – 9	10	62
Special / symbols	All printable ASCII not in the above, incl. space !"#$%&'()*+,-./:;<=>?@[\]^_`{\|}~ and space	33	95

Note: 95 is the total count of printable ASCII characters (codes 32–126). Subtracting the 62 alphanumeric characters leaves 33 special characters, which matches the set above.

02 — Where These Algorithms Are Used

The algorithm a site chooses is usually dictated by its platform or framework, so the realistic attack speed against your password depends on where you used it.

Algorithm	Commonly used by	Designed for passwords?
scrypt	Ethereum and other crypto wallets, Filecoin, Tarsnap, some Node.js apps	Yes — memory-hard
bcrypt	Django, Ruby on Rails, Laravel, Spring Security, PHP `password_hash()`	Yes — deliberately slow
PBKDF2-HMAC-SHA256	1Password, LastPass, Bitwarden, home Wi-Fi (WPA2), Microsoft .NET web app logins (ASP.NET Identity), iPhone backups	Yes — iteration-based
SHA-256	Linux `sha256crypt` shadow files, hand-rolled logins, Bitcoin, TLS certificates	Not on its own — general-purpose hash
NTLM	Windows local accounts and Active Directory domain credentials	No — unsalted and very fast
MD5	Legacy PHP/MySQL apps, older CMSes (WordPress < 2.5, phpBB), most breach dumps	No — broken; never use

03 — GPU Hash Rate Benchmarks

All rates come from hashcat benchmarks (hashcat -b), the industry standard tool for measuring offline password-cracking throughput. Community-published results are widely cross-referenced across security research and CTF communities.

Primary Source

hashcat benchmark wiki and community gists — e.g. Chick3nman's RTX 5090 benchmark (GitHub Gist)
NVIDIA published throughput comparisons for A100 vs H100: nvidia.com/h100

RTX 5090 (directly benchmarked)

Algorithm	Rate	Confidence
NTLM	340.1 GH/s	High — directly benchmarked (hash-mode 1000)
MD5	220.6 GH/s	High — directly benchmarked (hash-mode 0)
SHA-256	28.35 GH/s	High — directly benchmarked (hash-mode 1400)
PBKDF2-HMAC-SHA256 (600,000 iterations)	18,577 H/s	High — directly benchmarked (hash-mode 10900)
bcrypt (cost 10)	9,525 H/s	High — directly benchmarked (hash-mode 3200)
scrypt (N=16384, r=8, p=1)	7,760 H/s	High — directly benchmarked (hash-mode 8900)

bcrypt cost conversion: hashcat benchmarks mode 3200 at 32 iterations (cost 5), where the RTX 5090 reaches 304.8 kH/s. bcrypt work doubles per cost increment, so cost 10 is 2⁵ = 32× slower: 304,800 / 32 ≈ 9,525 H/s.

PBKDF2 iteration conversion: hashcat benchmarks mode 10900 at 999 iterations, where the RTX 5090 reaches 11,157.2 kH/s. PBKDF2 cost is linear in iteration count, so at the OWASP-recommended 600,000 iterations: 11,157,200 × 999 / 600,000 ≈ 18,577 H/s.

AWS p4d.24xlarge — 8× NVIDIA A100 (extrapolated)

Algorithm	Per-card rate	8-card total	Confidence
NTLM	~170 GH/s	1.36 TH/s	Medium — scaled at the same ~0.5× RTX 5090 ratio as MD5
MD5	~110 GH/s	880 GH/s	Medium — A100 is ~0.5× RTX 5090 on MD5; limited public bcrypt data
SHA-256	~11.3 GH/s	90.4 GH/s	Medium — extrapolated from FP32 relative throughput (~0.4× RTX 5090)
PBKDF2-HMAC-SHA256	~9,288 H/s	74,304 H/s	Lower — scaled at the same ~0.5× ratio as bcrypt; no public A100 figures
bcrypt (cost 10)	~4,800 H/s	38,400 H/s	Lower — bcrypt is memory-latency bound; fewer public A100 benchmarks exist
scrypt	~3,880 H/s	31,040 H/s	Lower — scrypt is memory-bandwidth bound; scaling may differ substantially

xAI Colossus — 100,000× NVIDIA H100 (extrapolated)

Algorithm	Per-card rate	Cluster total	Confidence
NTLM	~415 GH/s	41.5 PH/s	Medium — scaled at the same ~1.22× RTX 5090 ratio as MD5
MD5	~270 GH/s	27 PH/s	Medium — H100 is ~1.5–3× A100 depending on workload
SHA-256	~26 GH/s	2.6 PH/s	Medium — extrapolated from NVIDIA H100 spec comparisons
PBKDF2-HMAC-SHA256	~46,443 H/s	4.6 GH/s	Lower — scaled at the same ~2.5× ratio as bcrypt; no public H100 figures
bcrypt (cost 10)	~24,000 H/s	2.4 GH/s	Lower — bcrypt speedup over A100 is modest due to memory bottleneck
scrypt	~19,400 H/s	1.94 GH/s	Lower — memory-bandwidth bound; H100 HBM may over- or under-perform this

Caveat: A100 and H100 bcrypt, PBKDF2 and scrypt rates are extrapolated from architecture comparisons, not from directly observed hashcat -b runs on those GPUs. These GPUs are expensive enough that few researchers publish bcrypt benchmarks for them. The actual rates could be meaningfully higher or lower.

04 — Cost Estimates

Hardware Tiers — Electricity Only

Hardware purchase cost is excluded (the attacker already owns the machine). The running cost is modeled as electricity at the U.S. EIA average residential rate of $0.12/kWh (2024 average; source: U.S. Energy Information Administration).

cost_per_hour = power_draw_watts / 1000 × $0.12

Tier	Assumed draw	Calculation	$/hr
Single RTX 5090 (per-card basis)	~575 W	0.575 kW × $0.12	$0.069
Hacker Rig (8× RTX 5090)	~4,600 W	4.600 kW × $0.12	$0.552

Cloud Tiers — On-Demand Rental

Prices are AWS on-demand rates for US-East-1, as published at aws.amazon.com/ec2/pricing/on-demand/ (early 2025).

Tier	Instance	$/hr	Notes
Cloud Server	1× p4d.24xlarge	$32.77	AWS list price, on-demand
GPU Cluster	100× p4d.24xlarge	$3,277	100 × $32.77; linear scaling. Reserved pricing would be lower.

xAI Colossus — Estimated

xAI's Colossus cluster is not available for public rental. The cost is estimated from spot/on-demand H100 rental prices on the open GPU market:

Market providers (Lambda Labs, CoreWeave, Vast.ai): ~$2.00–$3.50 per H100 per hour as of early 2025
Estimate used: $2.50/H100/hr
Calculation: 100,000 × $2.50 = $250,000/hr

Caveat: The true operating cost of Colossus would also include capital amortization (~$25,000–$40,000 per H100 at 2024 list prices), networking, cooling, and facilities — making the real cost substantially higher. The $250,000/hr figure represents a conservative floor, not a ceiling.

Total Crack Cost Formula

total_cost = cost_per_hour × (time_seconds / 3600)

This is the expected cost at 50th percentile (median attempt). The attacker could get lucky and spend half as much, or unlucky and spend up to twice as much.

05 — The Theoretical Quantum Tier

The final tier is not a real machine. It exists to show what a fault-tolerant quantum computer would — and would not — do to a password hash.

Why quantum only helps quadratically

Shor's algorithm breaks RSA and elliptic-curve cryptography outright, but it does not apply to hash functions. The relevant algorithm for password cracking is Grover's search, which finds a preimage in about √N oracle evaluations instead of N/2. That is a quadratic speedup, not an exponential one: it effectively halves the bit strength of your password.

classical: attempts ≈ keyspace / 2 quantum: attempts ≈ √keyspace (Grover) time = attempts / oracle_rate

A 13-character password from a 95-character pool has a keyspace of ~5.1×10²⁵ (~85 bits). Grover reduces the search to ~7.1×10¹² iterations — the same effort as a ~43-bit password. Doubling your password length restores the original margin, which is why the standard guidance for symmetric primitives is simply “use twice the bits”.

Assumed oracle speed

The tier assumes 10⁶ logical hash-oracle evaluations per second for MD5, with the other algorithms scaled by their relative cost on the RTX 5090 benchmark. Error-corrected logical gates are many orders of magnitude slower than classical silicon, and every Grover iteration must evaluate the hash reversibly inside the quantum circuit, so this figure is generous rather than conservative.

Algorithm	Assumed oracle rate	Basis
MD5	1,000,000 /s	Anchor assumption
NTLM	1,542,000 /s	Scaled by NTLM ÷ MD5 on RTX 5090
SHA-256	128,500 /s	Scaled by SHA-256 ÷ MD5
PBKDF2-HMAC-SHA256	0.084 /s	600,000 iterations inside the oracle
bcrypt (cost 10)	0.043 /s	Scaled by bcrypt ÷ MD5
scrypt	0.035 /s	Scaled by scrypt ÷ MD5

Why this tier is less frightening than it sounds

Grover barely parallelises. Running M quantum machines in parallel gives only a √M speedup, so an attacker cannot buy their way out with fleet size the way a GPU cluster can.
A slow oracle only delays the crossover, it does not prevent it. The quantum tier's bcrypt oracle is ~1.8×10⁶× slower than the Hacker Rig's hash rate, so the Hacker Rig wins only while the keyspace is below ~1.3×10¹³ — about 7 characters from a 95-character pool. Above that the √keyspace reduction dominates and the quantum tier is faster. What it is not is dangerous: at 11 characters it still needs tens of thousands of years against bcrypt.
The quadratic speedup is a length problem, not a doomsday. Grover costs you half your bits, so adding characters restores the margin outright — there is no cliff-edge failure the way Shor's algorithm breaks RSA keys.
No such hardware exists. A Grover attack on even MD5 needs millions of high-fidelity logical qubits running for the full search; current devices have a few hundred noisy physical qubits.

Confidence: speculative. Unlike every other tier, no benchmark underpins these numbers. The √keyspace scaling is a firm mathematical result; the oracle rate is an illustrative assumption. Treat this tier as a teaching aid, not a forecast. The practical takeaway is unchanged: quantum computing threatens RSA/ECC key exchange, not well-hashed passwords.

06 — Key Assumptions & Limitations

What this calculator assumes

Offline attack only. The attacker has already obtained your hashed password (e.g. from a data breach) and is cracking it locally. Online attacks against a live login form are rate-limited by the server and take orders of magnitude longer.
Uniform random brute force. The attacker tries every combination in the character space systematically. Real attackers often use smarter strategies (see limitations below).
Attacker knows the character set. For example, if your password contains only lowercase letters, the attacker only searches that space. This is a common and reasonable attacker assumption post-breach.
50th percentile (median). On average, a password is found after half the keyspace has been searched. The 100th percentile (worst case for attacker) is exactly double the time shown.
bcrypt cost factor = 10. This is the default in many popular frameworks: Django, Rails, Spring Security, PHP's password_hash(). Cost factor 12 is ~4× slower; cost factor 14 is ~16× slower.
PBKDF2-HMAC-SHA256 = 600,000 iterations (current OWASP guidance) and scrypt N=16384, r=8, p=1 (the hashcat benchmark parameters, and the common "interactive" preset). Deployments using weaker parameters crack proportionally faster.
Single GPU type per tier. Real clusters mix hardware generations. The rates shown assume identical GPUs across the tier.

What this calculator does NOT model

Dictionary attacks. Common words, phrases, and patterns (e.g. P@ssw0rd) are cracked almost instantly regardless of what the complexity score shows, because attackers maintain wordlists of billions of known passwords.
Rule-based attacks. Hashcat rules can mutate wordlist entries (capitalize first letter, append a year, replace 'a' with '@') — dramatically extending effective dictionary coverage.
Rainbow tables. Precomputed hash lookups for unsalted algorithms. bcrypt uses per-password salts, making rainbow tables ineffective. MD5/SHA-256 without salting are vulnerable.
Password re-use. If you use the same password on multiple sites and one is breached in plaintext, length and complexity are irrelevant.
Side-channel and social engineering attacks. No amount of password complexity protects against phishing or keyloggers.

Bottom line: The times shown are accurate for random passwords against an attacker doing pure brute force. For passwords made of real words, names, or common substitutions, assume the actual crack time is far shorter than displayed.

07 — Worked Examples

Example A: "cat" — Hacker Rig, bcrypt

Pool: 26 (lowercase only) Length: 3 Keyspace: 26³ = 17,576 Expected guesses: 17,576 / 2 = 8,788 Hash rate: 76,200 H/s (8× RTX 5090, bcrypt cost 10) Time: 8,788 / 76,200 ≈ 0.12 seconds → "< 1 second"

Example B: "Tr0ub4dor&3" — Hacker Rig, bcrypt

Pool: 95 (lower + upper + digits + symbols) Length: 11 Keyspace: 95¹¹ = 5.69 × 10²¹ Expected guesses: 2.84 × 10²¹ Hash rate: 76,200 H/s Time: 2.84 × 10²¹ / 76,200 ≈ 3.73 × 10¹⁶ seconds ≈ 1.2 billion years

Example C: "Tr0ub4dor&3" — xAI Colossus, MD5

Pool: 95 Length: 11 Keyspace: 95¹¹ = 5.69 × 10²¹ Expected guesses: 2.84 × 10²¹ Hash rate: 27 × 10¹⁵ H/s (27 PH/s) Time: 2.84 × 10²¹ / 27 × 10¹⁵ ≈ 105,200 seconds ≈ 29 hours Cost: $250,000/hr × (105,200 / 3600) ≈ $7.3 million

Example D: "Tr0ub4dor&3" — Theoretical Quantum, MD5 vs bcrypt

Pool: 95 Length: 11 Keyspace: 95¹¹ = 5.69 × 10²¹ Grover attempts: √(5.69 × 10²¹) ≈ 7.5 × 10¹⁰ MD5 oracle 1,000,000 /s → 7.5 × 10⁴ seconds ≈ 21 hours bcrypt oracle 0.043 /s → 1.7 × 10¹² seconds ≈ 55,000 years

The same speculative machine cracks the MD5 hash in under a day. On bcrypt it is still faster than the Hacker Rig — ~55,000 years versus the rig's ~1.2 billion (Example B) — because at this length √keyspace more than compensates for the ~1.8×10⁶× slower oracle. The rig only wins below roughly 7 characters. The useful point is not who wins but the scale: a slow hash keeps even a quantum attacker in the tens of thousands of years, while the same machine finishes an MD5 hash overnight.

Insight: This illustrates why algorithm choice matters enormously. The same password takes over a billion years against bcrypt on an eight-card rig, but only 29 hours against MD5 on Colossus — a difference of roughly 10¹¹×. This is why modern systems use slow hashing algorithms.