I read that the Firefox Password Manager has a "bug" (or rather poor design) in that it uses only a single sha-1 hash iteration for the password (which makes it extremely easy to brute-force apparently). And this is done to the point where claims are being made that having a master password isn't even worth it (https://palant.de/2018/03/10/master-password-in-firefox-or-thunderbird-do-not-bother).

I wanted to know how secure/in-secure a single SHA-1 iteration really is, but I am not completely sure I understand the math.

Aparrantly the RTX 2080Ti has 12 GH/s on SHA-1. So let's say I have 4 of those. That would be 48 billion hashes per second. Now let's also say I have a (randomly generated) password that allows for 77 different characters and has a total length of 14 characters. Would the following math be correct:

([number of allowed chars] ^ [password length]) / [hash rate per second] / [seconds in a minute] / [minutes in a hour] / [hours in a day] / [days in a year] = [maximum number of years required to crack password]
So that would be:

(77 ^ 14) / 48000000000 / 60 / 60 / 24 / 365 = 170146221

So that means (if I am getting my math right) that it would take 170 million years to crack a 14 characters long password?


Your math is correct, but you calculated the time needed to test all 14-character long passwords.

The cracking time could be anywhere between now and in 170 millions years, based on your luck.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy