How fast passwords are cracked: hashing and password protection
How long password cracking takes with different hashing algorithms, why MD5 and SHA-1 are unsuitable, how dictionary and hybrid attacks work, and how to protect the passwords of employees and customers.
Websites and systems store passwords as a hash: the output of a one-way function from which the password cannot be calculated back. When a database leaks, the attacker tries millions of candidate passwords, hashes each one and looks for a match. How quickly that succeeds depends on the hashing algorithm and on the password itself.
Speed depends on the algorithm
A single modern graphics card checks more than 100 billion MD5 or NTLM hashes per second. These algorithms were designed to be fast, which makes them unsuitable for passwords. Password hashing algorithms (bcrypt, scrypt, Argon2) are deliberately slow: the same card checks only a few thousand bcrypt hashes per second at cost 10.
Approximate time for an exhaustive search on one graphics card:
| Password | MD5 or NTLM | bcrypt, cost 10 |
|---|---|---|
| 8 characters: lower and upper case letters and digits | under an hour | over 1,000 years |
| 12 lower case letters | about 10 days | hundreds of thousands of years |
Attackers use many cards at once, so real times are shorter. With a fast algorithm, eight-character passwords fall within minutes; with a slow algorithm, a long random password stays out of reach in practice.
The table applies only to random passwords
An exhaustive search is the last resort. Dictionary attacks come first, using lists of billions of passwords leaked in earlier breaches. Hybrid attacks follow, combining words with rules: a capital first letter, a year, an exclamation mark, "a" replaced with "@". A password such as Sofia2024! looks complex but is found quickly even with bcrypt, because it is among the first candidates of any rule set.
What users should do
- a unique password for every service, generated and stored in a password manager;
- a long password or a phrase of several random words where it has to be remembered, for example for the computer and the password manager;
- multi-factor authentication, so that a cracked password alone is not enough to log in;
- a check on haveibeenpwned.com of whether company addresses appear in known breaches.
What developers should do
- Hash passwords with Argon2id. If it is not available, use scrypt or bcrypt with a cost of at least 10. MD5, SHA-1 and single-pass SHA-256 are unsuitable.
- Give every password a unique random salt. Modern libraries do this automatically.
- Check new passwords against lists of leaked passwords and require length instead of special-character rules. This is also what NIST SP 800-63B recommends, and it advises against mandatory periodic password changes.
- Limit login attempts and enable multi-factor authentication, at least for administrators.
- If the system still holds old MD5 or SHA-1 hashes, rehash each password with the new algorithm at the user's next successful login, and require inactive accounts to set a new password.