Password policy and hash cost explorer

Change length, character sets, and hash algorithm, and watch the offline guessing time move. Then test which policy-compliant passwords fall first anyway.

Interactive lab
Beginner
5 steps
0 of 5 solved

Goal

A database of password hashes has leaked. How long the passwords survive depends on two things the attacker cannot change: the size of the keyspace, and how slow the hash is.

Change the length, character sets, algorithm, and hardware. Then test six passwords that a typical policy would accept. Guess rates are rounded public benchmarks for a high-end consumer GPU.

Length: 8

Character sets

Lowercase a–z (26) Uppercase A–Z (26) Digits 0–9 (10) Symbols (33)

Attacker hardware

95 symbols ^ 86.6 × 10^15 candidates

Time to try every candidate. On average an attacker finds a random password in half that time. The bar uses a log scale.

Policy: 8+ characters, upper, lower, digit, symbolMD5

Password	Meets policy	Found first by	Brute force alone
`Summer2026!`	yes	Season + year + symbol rule	1,127 years
`P@ssw0rd123`	yes	Breached-password wordlist	1,127 years
`Contoso#2026`	yes	Company name + year rule	107,019 years
`Welcome1!`	yes	Breached-password wordlist	46 days
`tq7#Vm2!pXr9`	yes	Brute force only	107,019 years
`copper lantern orbit meadow`	no	Brute force only (long passphrase)	1.3 × 10^29 years

Steps

01Eight characters from all four sets, hashed with MD5. How long does one GPU need to try every combination?
02Same password, now stored with bcrypt cost 12. Roughly how long?
03Which keyspace is larger?
04Of the six candidates, which policy-compliant password is not found by a wordlist or rule?
05What does current NIST guidance (SP 800-63B) recommend instead of composition rules?