Brute Force Protection Estimator

Estimate how long a password resists brute force

Understanding how long a password would take to crack by brute force shows why length and unpredictability matter. This tool estimates brute-force resistance, so you can reason about password and policy strength defensively.

Why the estimate teaches

Brute force tries every possible combination, and the time to exhaust the space grows exponentially with password length and the size of the character set, which is why a longer password is dramatically stronger than a slightly more complex short one. The estimate assumes a guessing rate, and different rates, a throttled login versus specialised hardware against stolen hashes, give very different times, which is itself an important lesson about where passwords are attacked.

What it means for your policy

The takeaway is that length and unpredictability dominate, and that how passwords are stored (a slow, salted hash) shapes how fast they can be attacked offline. Use the estimate to reason about a sensible password policy. This is for defensive assessment and education around systems you own or protect, or for authorised security testing and awareness, not for targeting others. It runs entirely in your browser, so nothing you enter is uploaded, which matters when the input concerns your own security posture.

Related tools

• Password Strength Checker — Measure password strength by entropy and pattern analysis rather than character-class rules. Checked entirely in your browser.
• Password Generator — Generate strong random passwords and passphrases in your browser using the Web Crypto API. Nothing is transmitted, logged or stored.
• Hash Generator — Generate MD5, SHA-1, SHA-256 and SHA-512 hashes in your browser. Compare checksums and verify file integrity with nothing uploaded to a server.
• Base64 Encoder/Decoder — Encode and decode Base64 in your browser, including URL-safe Base64 and UTF-8 text. Handles files and data URIs locally with nothing uploaded.