Brute-force calculator

Compare exhaustive guessing scenarios for uniformly random passwords or PINs. Set how they are generated and how fast an attacker can guess. You do not need to enter a password.

For a quick, as-you-type illustration, try the password crack time estimator.

Length (characters)

Alphabet size

Guesses per second

Count every character the generator can choose: 10 digits, 26 lowercase letters, 52 mixed-case letters, 62 letters and digits, or 94 printable ASCII characters excluding space. Use the generation alphabet, not the distinct characters visible in one password.

The default 10 billion guesses/second is an illustrative assumption, not a hardware benchmark. Change it to explore a measured rate or a hypothetical attack.

Calculate

Try a scenario: 4-digit PIN 6-digit PIN 12 random letters/digits

PIN examples assume 1,000 guesses/second with no lockout; they do not model a phone or bank's protections.

Calculations run locally in your browser. These results describe a search model, not a security rating.

What is being calculated?

For an alphabet of A choices and length L, there are N = A^L combinations. This assumes every position is chosen independently, repeats are allowed, and all combinations are equally likely. The corresponding entropy is L × log₂(A) bits.

At R guesses per second, trying all combinations takes N / R seconds. For one uniformly random target, trying each candidate once takes (N + 1) / (2 × R) seconds on average. An attacker could succeed on the first guess or the last. The model assumes the attacker knows the length and alphabet and maintains a constant rate.

Worked example: a random 4-digit PIN, including leading zeros, has 10⁴ = 10,000 possibilities. At 1,000 guesses/second, exhaustive search takes 10 seconds and the average is 5.0005 seconds (rounded to 5 in the calculator). Six digits give 1,000,000 possibilities: 100 times as many at the same rate.

Why there is no universal guessing speed

In an offline attack, someone with stolen password hashes can test guesses on their own hardware. The hash algorithm, its cost settings, and the attacker's hardware determine the rate. Password hashing schemes deliberately make each guess expensive; see OWASP's password storage guidance and our explanation of how passwords are stored.

Online logins and device PIN checks may impose delays, attempt limits, or lockouts. A constant-rate calculation does not model those protections. See why a short PIN can unlock a phone for that distinction.

When these numbers do not apply

A human-chosen password is not a uniform draw from an alphabet. Names, dates, repeated patterns, and leaked passwords may be guessed early regardless of length. Use the password pattern checker or PIN checker to explore those patterns; neither proves that a secret is safe.

For random-word passphrases, count word choices rather than characters: a list of W words and K independent draws gives W^K possibilities. The character-based presets do not estimate passphrase strength. Generator rules such as requiring at least one digit also change the search space, so this unrestricted model is an approximation for those generators.

Very large results use scientific notation and rounded durations (a year is 365 days). They are comparisons under the chosen assumptions, not forecasts of future hardware or promises of safety. To create a new password, use the password generator.