Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

This article states:

Brute-force techniques trying every possible combination of letters, numbers, and special characters had also succeeded at cracking all passwords of eight or fewer characters.

There are 6.63 quadrillion possible 8 character passwords that could be generated using the 94 numbers, letters, and symbols that can be typed on my keyboard. I'm skeptical that that many password combinations could actually be tested. Is it really possible to test that many possibilities in a less than a year in this day and age?

share|improve this question

2 Answers 2

up vote 8 down vote accepted

As per this link, with speed of 1,000,000,000 Passwords/sec, cracking a 8 character password composed using 96 characters takes 83.5 days. But a recent research presented at Password^12 in Norway, shows that 8 character passwords are no more safe. They can be cracked in 6 hours.

But one important thing to consider is which algorithm is used to create these hashes (assuming you are talking about hashed passwords). If some computationally intensive algorithm is used, then the rate of password cracking can be reduced significantly. In the link above, author highlights that "the new cluster, even with its four-fold increase in speed, can make only 71,000 guesses against Bcrypt and 364,000 guesses against SHA512crypt."

share|improve this answer
My core i3 laptop makes 1500 guesses per second on WPA handshake. –  Vorac Oct 11 '13 at 13:20
For single iteration MD5, small GPU arrays (<20 cards) are now pushing into the 100Billion/second area. Large (intelligence agency) arrays will be several orders of magnitude faster. –  lynks Oct 11 '13 at 13:34
One thing to keep in mind is that NTLMv1 passwords are particularly easy and so should not be extrapolated from. Because of how NTLM hashes passwords a 16 character password is takes only twice the amount of time to crack as an 8 character one. –  Jeffrey Goldberg Oct 12 '13 at 4:19
Don't forget about salts. If an encryption algorithm uses arbitrary-length salts, it's effectively impossible to create all possible hashes with all possible salts (you'd need a new rainbow table for every possible salt). –  Joe Jan 29 at 21:53

Possible? yes, but what brute force recovery duration is accepted as possible? Some numbers for 8 chars PW if randomly chosen from a 94 character set:

  • Windows PW (NTLM:1), using the above metioned 25 GPU recovery monster: 2.2 hours on average
  • WiFi (PBKDF2/SHA1:4096) using an 8 GPU recovery system: 98 year on average
  • 7ZIP (PBKDF2/SHA256:262144) using an 8 GPU recovery system: 26 centuries

So it is 'possible' for certain cases for us, may be yes in all above cases for some agencies.

Suppose your set of 'obtained' hashes contained 5 million password hashes, then even for the 98 year WiFi case, 145 keys will be found on day 1 (on average). If your password is amongst them, then you experience that also for the WiFi case it is indeed possible! .... if my calculations are right

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.