Solved Are Your Passwords in the Green?

cereberus · Nov 20, 2025

Borg 386 said:
View attachment 153670

The 2026 Password Table Is Here: How Fast Can a Hacker Crack Your Password?

The 2026 Hive Systems Password Table is here. This year's cracking rig is a rented 16x RTX 5090 fleet running against bcrypt, and was about 24% faster than last year. See the latest brute force times, why AI makes the rig easier to build but can't crack bcrypt itself, and what quantum really threate

www.hivesystems.com

How can anyone prove times over 5 years since they only started in 2020?

Some of the longer times are longer than Homo Sapiens has existed!

Try3 · Nov 20, 2025

cereberus said:
How can anyone prove times over 5 years since they only started in 2020?

I suspect that they have simplified the presentation of their results.
I suspect that they have calculated probabilities of brute-force cracking of passwords based on the speed of their actual/imagined decoder and extrapolated those probabilities to the periods shown in their results table.
They might, for example, regard a password as crackable when they reach a 50% chance of cracking it within some given period of trying [such as 100 hours decoding work].
But their webpage does not provide sufficient explanation of their method or their analysis assumptions.

All the best,
Denis

DJNelson · Nov 20, 2025

The table in this thread is based on simple math. Assuming the number of possible calculations per second is fixed for eternity, the time it takes to brute force a password is directly proportional to the number of possible permutations in the given format.

Try3 · Nov 20, 2025

DJNelson said:
The table in this thread is based on simple math

The only way to reduce it to simple maths, to eliminate probabilities, would be for their table to report

Try3 said:
estimated times for you to be certain that a hacker would be able to crack the password

but that would definitely provide an unduly optimistic estimate to the user because that would effectively assume that the hacker did not get the password right until trying the very last possible permutation.

HiveSystems tables have been discussed before - see, for example,
Brute force time chart - my post #11 - TenForums
and the rest of the discussion in that thread.

All the best,
Denis

Steve C · Nov 21, 2025

Oddly my computer says all my passwords are ************

:lmao:

A Guy · Nov 21, 2025

A Guy

pseymour · Nov 21, 2025

Four common English words would be cracked in a couple of minutes.

A Guy · Nov 21, 2025

Not something I would use, but the majority of password testers say a 4 common word password is very strong

A Guy

pseymour · Nov 21, 2025

Well they’re wrong. Hashcat-like tools would make short work of that. They can combine a set of, say, a few thousand words and attack with those hashes. That password is effectively the same as ‘chbs.’

Long passwords are better than short ones, but not if you use common English words. And all lower case to boot? Yikes.

A Guy · Nov 21, 2025

https://www.cyber.gov.au/learn-basics/explore-basics/passphrases

A Guy

pseymour · Nov 21, 2025

Yes, bad advice is often repeated. If we want to play the game of finding a single article from imright.com to backup what we already think, I can do

CorrectHorseBatteryStaple isn’t a good password. Here’s why. | Pen Test Partners

We all know that complexity and length make for good passwords, but much has been made of combining dictionary words to make long passwords. XKCD made a big deal of choosing 4 random dictionary words with the amusing ‘correcthorsebatterystaple’ suggestion for an amazingly strong password, but...

www.pentestpartners.com

That article is from 2014. It was a bad idea back then, and a worse idea now.

But there’s no need to debate this. Keep passing out bad password advice from 2011, from a physicist, who has been doing web comics for almost 20 years. It affects me not.

Borg 386 · Nov 21, 2025

Sad but yes, sometimes it's that easy.....

A Guy · Nov 22, 2025

pseymour said:
Yes, bad advice is often repeated. If we want to play the game of finding a single article from imright.com to backup what we already think, I can do

CorrectHorseBatteryStaple isn’t a good password. Here’s why. | Pen Test Partners

We all know that complexity and length make for good passwords, but much has been made of combining dictionary words to make long passwords. XKCD made a big deal of choosing 4 random dictionary words with the amusing ‘correcthorsebatterystaple’ suggestion for an amazingly strong password, but...

www.pentestpartners.com

That article is from 2014. It was a bad idea back then, and a worse idea now.

But there’s no need to debate this. Keep passing out bad password advice from 2011, from a physicist, who has been doing web comics for almost 20 years. It affects me not.

I'm no expert but apparently you are, so have at it. Gemini AI thinks

how long for Hashcat to crack the password butterfriendhaplesscanary

See my thinking

Password characteristics

Length: 26 characters (four lowercase English words).
Alphabet: 26 lowercase letters.
Search space (pure brute force):

2626≈6.56×103626^{26} \approx 6.56 \times 10^{36}

Brute-force time with fast hashes

Assume 10^{11} guesses/second (roughly high-end GPU on very fast hashes like MD5/SHA-1):

6.56×10361011=6.56×1025 seconds≈2.08×1018 years\frac{6.56 \times 10^{36}}{10^{11}} = 6.56 \times 10^{25} \text{ seconds} \approx 2.08 \times 10^{18} \text{ years}

Assume 10^{9} guesses/second (more conservative):

6.56×1036109=6.56×1027 seconds≈2.08×1020 years\frac{6.56 \times 10^{36}}{10^{9}} = 6.56 \times 10^{27} \text{ seconds} \approx 2.08 \times 10^{20} \text{ years}
Conclusion for pure brute force: effectively impossible.

Impact of hash type

Fast hashes (MD5, SHA-1, NTLM): Enormous speed, but still nowhere near enough for 262626^{26}.
Slow hashes (bcrypt, PBKDF2, scrypt, Argon2): Typical speeds can be 10310^{3}–10510^{5} guesses/second or less, which makes brute force even more infeasible by many orders of magnitude.

Realistic attacks beyond brute force

Known-phrase lists: If the exact passphrase is in a wordlist, Hashcat can crack it almost instantly using a straight dictionary attack.
Four-word passphrase model: If an attacker targets “four lowercase words concatenated,” the space depends on the wordlist size.
- With a 50,000-word list:

50,0004=6.25×101850{,}000^{4} = 6.25 \times 10^{18}
At 10910^{9} guesses/second (fast hash), that’s about 2 years; at 10710^{7} guesses/second, ~6300 years. Real speeds and generation overhead vary, and slow hashes make this astronomically longer.

Smaller curated lists: Attackers often use smaller, high-probability wordlists (e.g., 2–5k common words), which can shrink the space dramatically. If your four words happen to be in such lists, risk rises.

Direct answer

Pure brute force: longer than the lifetime of the universe for fast hashes, and vastly worse for slow hashes.
Smart word-based attacks: only feasible if your exact words (and ordering) are within the attacker’s wordlists or models. Otherwise, still impractically large.

Hardening tips

Increase unpredictability: Add capitalization, separators, numbers, or an uncommon non-English word.
Use slow hashing: Ensure your system uses bcrypt, scrypt, PBKDF2, or Argon2.
Prefer a password manager: Generate random passwords for sites; keep passphrases for master passwords only.

A Guy

Scannerman · Nov 22, 2025

Ya'll are so concerned about passwords while AI is pulling this sort of thing:

I foresee a much darker future lies ahead for my grand children. Pass words will be among the least of their worries.

pseymour · Nov 23, 2025

I guess now we’ve moved from web comics to AI for password advice. I asked Gemini your same question, and it included things such as :

“Dictionary Attack: Since it's composed of several real English words, it is vulnerable to a dictionary attack or a combinator attack (which combines dictionary words). This is the most likely way it would be cracked, and it would be cracked much faster than a pure brute-force attack.”

“If the words in your passphrase exist in the hacker's wordlists (which they almost certainly do), the crack time could drop from potentially billions of years to minutes, hours, or days, depending on the quality of the attacker's wordlists and their rules for combining words.”

The math given in your Gemini answer is for a brute force attack on the 26 lowercase English letters, which is not at all the same as a dictionary attack, and completely irrelevant.

PhilB · Nov 23, 2025

hader said:
There is one system that can replace everything; Bio-metrics. Microsoft is pressing towards that direction with also much security company's with them. Bought a fingerprint scanner. It just works as a dream for login into my system. Our phone sometimes also demands it. So why not in general? I think this the final solution. Every body's physical fingerprint is unique. It's save. Saver than a face recognition. Someone can take your picture and show it to the scanner. Don't! What's against a fingerprint? Yeah like criminals like to hack your thumb or other fingers off to get access. Very unlikely. Only if the price is Billions. The world is becoming more complicated. It has something (unfortunate) to deal with. But what about company's? A few days ago; Your email has been powned (again) by criminals and stole your e-mail and passwords. Some company's let their guard down and didn't implemented patches on a regular basis. (want not to spend much money on our IT....) Let's sue them massively. It's being arround for decades. You should think they are aware by now? And take measures? Nope, time and time again. Do not want to spend to much money on security.... My personal data for sell on Telegram for any criminal to buy and to exploit with phishing mails..... Yeah. I had enough of that.

I am the only one that sees this? No absolutely not. Others see it too. It's not an easy subject. You must a have a bigger understanding how things works.

Fingerprints can be faked.

Retina scans, not. But who wants to have a retina scan done just to log into their PC or website?

Stigg · Nov 24, 2025

Google Password Manager reports that many of my passwords have been leaked and compromised online even though I think most of my passwords are quite complex. So, it really doesn't matter how complex your passwords are if websites are gonna let them leak.

I blame some forums for leaking some of my passwords.

Scannerman · Nov 24, 2025

Stigg said:
Google Password Manager reports that many of my passwords have been leaked and compromised online even though I think most of my passwords are quite complex. So, it really doesn't matter how complex your passwords are if websites are gonna let them leak.

I blame some forums for leaking some of my passwords.

I don't use password managers but I do use Kaspersky Premium and it is very efficient at identifying web sites that leak your data.

Hats off to the Windows Eleven Forum.

According to Kaspserky this forum is leak proof. (So far) :clap:

*edit* Here's just an example. Kaspersky can check so much more than this and it is considerably more user friendly than it used to be.

Solved Are Your Passwords in the Green?

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Righteous Dude

My Computers My Computers

At a glance

At a glance

tell me again what you think about OneDrive

My Computer My Computer

At a glance

Righteous Dude

My Computers My Computers

At a glance

At a glance

tell me again what you think about OneDrive

My Computer My Computer

At a glance

Righteous Dude

My Computers My Computers

At a glance

At a glance

tell me again what you think about OneDrive

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Righteous Dude

Password characteristics​

Brute-force time with fast hashes​

Impact of hash type​

Realistic attacks beyond brute force​

Direct answer​

Hardening tips​

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

tell me again what you think about OneDrive

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Similar threads

My Computer

My Computer

My Computer

My Computer

My Computer

My Computers

My Computer

My Computers

My Computer

My Computers

My Computer

My Computer

Password characteristics

Brute-force time with fast hashes

Impact of hash type

Realistic attacks beyond brute force

Direct answer

Hardening tips

My Computers

My Computer

My Computer

My Computer

My Computers

My Computer