Local privacy-first tool
Brute-Force Time Calculator
Model an average exhaustive search under a stated guess rate. The result is educational, not a prediction.
Private by design: values stay inside the isolated tool origin and are not sent to this page, analytics, advertising, storage, or server logs.
Assumptions control the result
The calculator assumes independent uniform random selection and reports the average time to search half the space. Real attackers prioritize common choices, reuse breached credentials, parallelize hardware, or exploit recovery and phishing paths. Human passwords therefore do not follow this model.
Online and offline attacks differ
Online guessing should be constrained by rate limits, detection and MFA. Offline guessing becomes possible after password-hash theft; cost then depends on the hashing algorithm, salt, work factor and hardware. Fast unsalted hashes can be attacked far faster than well-configured memory-hard hashes.
Do not quote the largest number
A spectacular duration does not certify safety. State the pool, length, generation method, guess rate and attack model whenever you use a result.
Choose an honest guess-rate assumption
An online rate should reflect throttling, detection and account controls. An offline rate depends on the stolen hash format, cost parameters and hardware. A single fashionable guesses-per-second number cannot describe every service.
Average time versus worst case
For a uniformly random target and exhaustive search, the average result is half the complete space. The target might appear on the first guess or the last. Human-created passwords are not uniformly positioned because attackers prioritize likely patterns.
What the calculator deliberately excludes
It does not model leaked-password dictionaries, personal information, credential stuffing, phishing, malware, parallel botnets, adaptive rules or future hardware. It also cannot inspect how a particular service stores passwords.
Use the result to compare, not certify
Compare two random policies under the same assumptions. Then choose a useful margin and add uniqueness, storage, MFA and recovery controls. Never publish the largest displayed duration as proof that a real account cannot be compromised.