Calculate brute-force attack times based on hash rate, password complexity, and character set size.
Hash Rate Calculator estimates how long exhaustive guessing would take for a fixed-length password space. It raises the character set size to the password length to obtain the number of possible candidates, then relates that count to the supplied testing rate. The result is a mathematical estimate, not a cracking benchmark. The most common mistake is entering a convenient hashes-per-second figure rather than a measured candidate-verification rate for the exact hash or password-hashing configuration and hardware being assessed.
For length L and a character set containing N possible characters at every position, the search space contains N^L candidates. Adding one character therefore multiplies the space by N. This model applies cleanly only when every position uses the same set. If positions have different allowed sets, their individual counts must instead be multiplied.
At a sustained rate of R complete candidate checks per second, testing the entire space takes N^L divided by R seconds. If the target is uniformly distributed and candidates are tested without repetition, expected discovery occurs after approximately half the space. A human-selected password usually does not satisfy that uniformity assumption, so the halfway figure is not a general prediction.
No. It describes a defined search space at a constant supplied rate. It is most meaningful for randomly generated passwords that match the selected length and character set. Human-created passwords have uneven probabilities, and attackers commonly test likely words, substitutions, patterns, and previously exposed passwords before attempting every possible string.
Count the characters that could genuinely appear at each position, not the number of distinct characters present in one chosen password. Lowercase English letters give 26 possibilities per unrestricted position, for example. If a format forces different sets at different positions, a single character-set value does not model it exactly; calculate the product of the position-specific possibilities.
The behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Generate strong, random passwords with customizable length, character sets, and complexity requirements.
Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.
Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.
Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.
Scan and decode QR codes from uploaded images or your device camera to extract embedded data.
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.