Password Strength Estimators: Crack Time Scores Explained

Password strength estimators display a “crack time” score that predicts how long an offline attacker would need to guess your password. The number comes from a mathematical model of guessing strategies, not a live test, and it is meant as a rough ranking tool, not a precise timer. This article explains how those scores are calculated, what they really tell you, and where they fall short.

Formula

The core formula used by many estimators is:

Estimated time = 2^entropy / guesses_per_second

• entropy (bits): a measure of how many possible passwords exist in the same “pattern class” as yours. Each bit doubles the search space.
• guesses_per_second: the assumed speed of an offline attacker, often set between 10⁹ and 10¹² guesses per second for a powerful GPU cluster.
• Estimated time (seconds): the average number of guesses needed (half the search space) divided by the guess rate.

The entropy value itself is usually estimated by a tool like zxcvbn, which breaks your password into recognizable patterns (words, dates, sequences, repeats) and sums the bits contributed by each part.

Worked Example

Using the calculator defaults: entropy = 40 bits, guesses per second = 10⁹.

1. Search space = 2⁴⁰ = 1,099,511,627,776 possible passwords.
2. Average guesses to crack = half of that = 549,755,813,888.
3. Time = 549,755,813,888 / 10⁹ ≈ 549.8 seconds.
4. In years: 549.8 / (365.25 × 24 × 3600) ≈ 0.0000174 years.

The calculator shows about 550 seconds (roughly 9 minutes) and 0.0 years. That is the same result the formula gives.

How Estimators Actually Work

Modern estimators do not simply count characters. They use a dictionary of common passwords, names, words, and leaked password lists, then look for patterns:

• Keyboard patterns (qwerty, asdf, 1234)
• Dates (1990, 12/25/1990)
• Repeated characters (aaa, 111)
• Leetspeak substitutions (p@ssw0rd)
• Common phrases (iloveyou, letmein)

Each pattern has a probability based on how often it appears in real password datasets. The estimator multiplies those probabilities to get an overall entropy. A password like “Tr0ub4dor&3” might be scored as a few dictionary words plus substitutions, giving maybe 28–30 bits, while a random 12-character string of uppercase, lowercase, digits, and symbols might get 70+ bits.

What the Score Really Means

The crack time is a relative measure, not an absolute guarantee. It tells you how your password compares to others in the same pattern class under a specific attack model. A score of “3 hours” means that if an attacker knows your password follows the pattern the estimator detected, and they have the assumed hardware, they would likely find it within that time. It does not mean a human will sit at a keyboard for three hours; it means a script can try billions of guesses per second.

Key implications:

• A score of “centuries” for a random 20-character password is realistic because the search space is astronomically large.
• A score of “seconds” for a common phrase is also realistic because the estimator knows that phrase appears in leaked lists.
• The score assumes the attacker has your password hash and can try offline. Online attacks (typing into a login form) are much slower, often limited to a few attempts per second, so a password that cracks in minutes offline could still resist an online brute-force for years.

Common Misconceptions

“A long crack time means my password is uncrackable.” No. It only means the specific model did not find a shortcut. If your password is a variation of a common phrase, a better dictionary or a smarter rule could crack it much faster.

“All estimators give the same score.” They do not. Different tools use different dictionaries, pattern lists, and guess-rate assumptions. A password might get “2 hours” in one tool and “3 days” in another. The score is only meaningful when compared within the same tool.

“Adding a digit at the end doubles my security.” Only if the digit is random and not predictable. Adding “1” to “password” gives “password1”, which is in almost every dictionary. The estimator sees it as the same word plus a common suffix.

How to Choose a Strong Password

Instead of chasing a high crack-time score, focus on entropy and randomness:

• Use a password manager to generate and store a random string of at least 16 characters.
• If you must memorize, use a passphrase of 4–5 random words (e.g., “correct horse battery staple”) — but only if the words are chosen randomly, not a famous quote.
• Avoid personal information, keyboard patterns, and single dictionary words.
• Never reuse passwords across sites. A breach on one site can expose your password for others.

The best estimator is the one built into your password manager, which often uses zxcvbn or a similar algorithm. A score of “strong” there is a good sign, but the real test is whether the password was randomly generated.

Limits of the Model

The crack-time formula assumes a brute-force attack that tries every possible combination in order. Real attackers use smarter strategies:

• Dictionary attacks with leaked passwords and mutations.
• Rule-based attacks that add digits, symbols, or capitalize in common ways.
• Markov chains that generate likely sequences based on human typing habits.
• Phishing and keyloggers that bypass guessing entirely.

A password with high entropy can still be stolen through a phishing email or a keylogger on your device. No estimator accounts for those threats. The crack time only measures resistance to offline guessing, not to social engineering or malware.

Also, the guess rate is a moving target. Hardware improves, and attackers may use specialized chips or cloud GPUs. A password that takes “100 years” today might take “10 years” in a decade — still long, but the point is the number is not fixed.

Frequently Asked Questions

Why does my password show a crack time of “centuries” but a website says it’s weak? Different tools use different criteria. A website might reject short passwords or require a mix of character types for policy reasons, even if the entropy is high. The crack-time estimate only measures guessing resistance, not policy compliance.

Is a crack time of 1 hour safe for a bank account? Not really. Banks usually lock accounts after a few failed attempts, so an online attacker cannot try billions of guesses. However, if the bank’s database is breached and hashes are leaked, an offline attacker could crack that password in an hour. Use a unique, high-entropy password for financial accounts.

What is a good crack time to aim for? Most security experts suggest a password with at least 60–70 bits of entropy, which typically corresponds to a crack time of centuries under current hardware. But the exact number matters less than the password being random and unique.

Does changing my password regularly improve crack time? No. The crack time is based on the password itself, not its age. Regular changes only help if the old password was compromised. In fact, frequent changes often lead to weaker passwords because people make small variations.

Can I trust the crack time shown by a random website? Be cautious. Some sites use the estimate as a marketing tool or to encourage you to sign up. Use well-known estimators like zxcvbn (open source) or the one in your password manager, and treat the number as a rough guide, not a guarantee.

Why does a longer password sometimes show a shorter crack time than a shorter one? Because the estimator may detect a pattern in the longer password. For example, “passwordpassword” is long but has low entropy because it is a repeated common word. A shorter random string like “k#9Fm2!q” has higher entropy per character and may score better.

Related

• CB1 Crystal Structures: New Activation Insights
• Check RAM Speed on Windows 11 (Easy Steps)
• Excel Enter Dates Without Slashes: 4 Ways

in entropy | Password entropy | bits | 40 | 0
in guesses | Guesses per second | 1e9 | 1e9 | 0
out crack_time | Estimated crack time | seconds | 2^entropy / guesses | 0
out crack_years | Crack time in years | years | (2^entropy / guesses) / (365.25 * 24 * 3600) | 1