How long would your password survive?

We estimate the password’s entropy in bits, take half the keyspace (the average number of guesses to find it), and divide by an attacker’s guess rate. Each scenario uses a different rate, from ~100 guesses/sec for a throttled login to ~10 trillion/sec for purpose-built hardware.

Attack speed depends entirely on context. A login form that rate-limits attempts is millions of times slower than an attacker who has stolen the password hashes and runs them offline on GPUs — especially if the hashes use a fast algorithm like MD5 or SHA-1 instead of bcrypt or Argon2.

No — they are order-of-magnitude estimates. Real attacks use dictionaries and rules that crack weak passwords far faster than pure brute-force, and hardware keeps getting faster. Treat the offline-GPU column as the realistic worst case and aim for a time measured in centuries there.

For important accounts, you want the offline fast-hash scenario to read in the millions of years. That corresponds to roughly 80+ bits of entropy — about a 13-character random password (all character classes) or an 8-word passphrase.