Suppose that we have a process that generates passwords with entropy E.

I'd like to compute the average time it would take for a brute-force attack to crack an MD5-hashed instance of such a password.

From the entropy E (in bits), I can compute the total number N = 2E of candidate passwords in the universe from which a given password was chosen. On average, a brute-force attack would have to MD5-hash N/2 candidate passwords in order to crack a specific instance.

But this calculation does not give me the amount of time that this would take. For this I need some multiplier for computational performance, something of the form "x candidate passwords/second".

I imagine that computer security experts have some rule-of-thumb number to plug in for such multiplier x. If so, what is it?

(Of course, if the multiplier x does not take into account the possibility of multiple processors working in parallel, then whatever time one computes using such a multiplier would have to be divided by the number P of processors that the attacker can have running in parallel. If there's a standard rule-of-thumb-like value for P, I'd be interested in that too.)


The term you're looking for is "hash rate", and a quick Google search indicates that a GPU-based password cracker can try on the order of 10^10 passwords per second when cracking MD5 hashes.

Generating hashes is an example of an "embarrassingly parallel" process, so doubling the available computing resources will double your hash rate.

  • Hash cat has a useful list to get an idea of the speed hashes can be calculated at. hashcat.net/oclhashcat/#performance
    – Hybrid
    Aug 21 '14 at 2:55
  • The question and the answer might mislead the reader because they seem to suggest that the best way to guess the MD5 hash is brute-force. But that is not the case! MD5 has been cryptanalyzed, an actual microsoft site has been spoofed because of that, and that's why all reasonable certificate authorities avoid MD5 (sha256 is the current standard).
    – Lionel
    Aug 21 '14 at 3:43
  • 4
    @Lionel, the attacks on MD5 are collision attacks, where you generate a pair of inputs with the same hash. These are totally useless for cracking passwords: for that, you need a preimage attack, where you generate an input with a pre-determined hash. The best known preimage attack on MD5 is only slightly better than brute force, and is much harder than guessing passwords.
    – Mark
    Aug 21 '14 at 3:50
  • @Mark, point taken, I'm confusing two different things. The CA attack was based on collision, and what the question is asking is preimage. That being said there exist published preimage attacks that are 2 or 3 orders of magnitude faster than brute force. This is still unmanageably complex, but arguably superior to brute force. I was mainly trying to warn casual readers about the known weakness of MD5.
    – Lionel
    Aug 21 '14 at 4:08
  • @Lionel What Mark is trying to say is that practical password cracking does not benefit from any of the published cryptographic weaknesses of MD5. The biggest downside of hashing passwords with MD5 is that it is a very fast hashing algorithm, which likewise makes cracking passwords hashed with it very quick.
    – PwdRsch
    Aug 21 '14 at 15:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.