Brute Force Time
Calculator

It estimates how long it would take an attacker to guess a password purely by brute force, trying combinations systematically, based on the password's entropy (bits) and an assumed number of guesses the attacker can attempt per second.

The result depends heavily on the assumed guessing speed, which can range from a few attempts per second (an online login form with lockouts) to billions or trillions per second (an offline attack using specialized hardware against a leaked password database). Always check what guessing-speed assumption is being used.

No, real-world attackers rarely try every possible combination in order; they typically use dictionaries, known-password lists, and pattern-based rules that find common or previously breached passwords far faster than brute force would suggest. This means the true time-to-crack for a weak but 'high entropy-looking' password can be much shorter than the brute-force estimate.

For high-entropy passwords, brute-force time estimates can exceed the age of the universe many times over. This isn't a meaningful prediction of real-world risk at that point — it simply illustrates that brute force alone is not a viable attack method against that password, so security concerns shift to other attack vectors like phishing or data breaches.

Use it to compare the relative strength of different password choices and understand why length matters so much, rather than treating the exact time figure as a literal guarantee — real-world password security depends on more than resistance to brute force alone.