Estimate an exhaustive password search
Explore how hash mode, character set and password length affect an authorized password audit. The estimate is indicative; real results depend on hardware, configuration and search strategy.
Set the audit parameters
Choose a specific supported mode. The estimator uses the speed profile associated with that mode.
Choose lengths from 1 to 29 characters. Estimates refresh as you change the settings.
Select a supported hash mode and at least one character set.
Estimated search space and duration
- Candidate passwords
- -
- Estimated duration
- -
How to interpret this estimate
The candidate count is the size of the selected search space across the chosen length range. The duration estimate uses OHC’s current reference speed for the selected hash mode; it is not a promise of recovery time or proof that a password is secure.
Use the estimate to support an authorized security assessment and remediation plan. Real audits may use wordlists, rules, masks or targeted searches, and salted or deliberately slow password hashes can materially change the work required.
Frequently asked questions
How is the brute-force search space calculated?
It is the size of the character set raised to each password length, summed over the chosen length range. Every extra character multiplies the work by the size of the character set.
Why does the hash algorithm change the estimate?
Fast algorithms such as MD5 or NTLM allow vastly more guesses per second than deliberately slow ones such as bcrypt or scrypt, so the same search space takes very different times.
Is the estimate a guarantee?
No. It is an indicative planning figure based on OnlineHashCrack's reference speed for the selected hash mode. Wordlists, rules and masks can find a password much sooner, and a password not found in a given search is not proven strong.
Can I run a brute-force job on OnlineHashCrack?
Yes, for data you own or are explicitly authorized to test. Custom GPU jobs let you choose a character set and length range, and you see the price before anything starts.
Turn an estimate into an authorized brute-force job on OHC’s GPU-accelerated service.
Discuss your authorized audit