Brute-Force/Hash Cracking Time Estimator
Estimate how long a brute-force attack would take, at a range of realistic attack speeds.
About this tool
Assumes a pure brute-force search of the full keyspace (no dictionary words, patterns, or known-password reuse — real attacks are usually much smarter than this, so treat these as an optimistic upper bound on how long you're protected, not a guarantee). Hash rates are based on published hashcat benchmarks for a single high-end consumer GPU (RTX 4090-class), with bcrypt at the common cost factor of 10; a real attacker may have many more GPUs, though the huge speed difference between fast hashes (SHA-256) and adaptive ones (bcrypt) tells the real story here — bcrypt resists GPU parallelisation by design, which is exactly why it's still recommended for password storage.
Because this assumes a blind search, a password made from a dictionary word with a number on the end looks far stronger here than it really is. To see how a real cracking tool would treat your password, with its word lists and common patterns, use the Password Strength Checker. Very long passwords are handled too: the times are worked out with logarithms, so even a 100-character password gives a real answer rather than "infinity".