Password recovery time calculator

Why is password recovery so difficult? Let’s explain the principles and computational requirements in this article

The essence of password recovery is to continuously try out all possible combinations until the correct one is found. The faster you try, and the fewer combinations you test, the higher the chances of success. On the other hand, the more combinations there are, and the more time it takes to try each combination, the less likely it is to succeed. This calculator helps to quantify both the number of attempts required and the time spent on each attempt. This allows you to have a better understanding of the security level of your files, and to understand why some files can be opened in just a few minutes, while others cannot even be opened despite being tried multiple times.

1. Brute-force attacks: Trying all possible combinations one by one

Brute force attacks rely on nothing but exhaustive enumeration of all possible combinations based on the character set and length of the password. For example, there are only one hundred million possible combinations for an 8-digit string of pure numbers. However, an 8-digit password consisting of uppercase and lowercase letters, numbers, and symbols has more than 6×10¹⁴ possible combinations. Such attacks proceed from “aaaaaaa” down to the last possible combination. The advantage of this method is that it’s both the simplest and most reliable approach—as long as there’s enough time, it’s theoretically possible to find every possible combination. The downside is that the number of possible combinations grows exponentially with increasing length and character set size. For even slightly longer passwords, it would take countless generations of attempts to find them.

II. Dictionary attacks: Start with passwords that most closely resemble human language

Most people don’t use random characters as passwords. Instead, they use things like birthdays, names, keyboard sequences (like “qwerty”), or common words. Dictionary attacks organize these frequently used passwords into lists of possible candidates, and try each one one by one. This often leads to the discovery of weak passwords within a few minutes. The efficiency of this method is much higher than brute-force attacks, but it only works if the password actually exists in the list of possible candidates. Of course, this method becomes ineffective when dealing with highly randomized passwords. We have accumulated and cleaned up countless passwords over the years, precisely to improve the success rate of such attacks.

III. Masked Attacks: Adding “known conditions” to brute-force attacks

Mask attacks are a more sophisticated version of brute-force attacks. If you remember that “the password should be 8 characters long, start with a capital letter, and end with 2024”, you can provide these conditions to the cracking program, allowing it to generate only those combinations that meet the requirements. The original set of 6×10¹⁴ possible passwords can be reduced to just a few hundred million possibilities in just a few hours. This is why providing as many clues as you can when submitting the task will significantly increase the chances of success.

IV. Why is there a difference of tens of thousands of times in the difficulty of solving problems with different formats? – The number of hash iterations

The files are not compared directly to the password, but rather to the “hash value” generated from the password. Every time a password is tried, the program must perform a hash operation. The more iterations there are, the slower the process becomes. The old formats offer almost no protection: Office 97 uses MD5/RC4, and graphics cards can perform tens of millions of such operations per second. In contrast, Office 2013 uses PBKDF2, which requires around 100,000 iterations per second—meaning it’s only about 10,000 times slower. PDFs use RC4, which is quite weak, while AES is slightly stronger. RAR5 requires around 30,000 iterations per file, making it several dozen times slower than RAR3. 7Z, on the other hand, requires over 500,000 iterations per file, making it one of the most difficult formats to crack. The reason why the same password might take dozens of minutes to be cracked on someone else’s machine, while taking days for you to try without any results, lies precisely here.

V. The difference in computing power between graphics cards (GPUs) and CPUs

Hashing operations are a typical type of computation that involves many identical tasks, each independent of the others. This makes hashing particularly suitable for parallel processing architectures. A mainstream gaming graphics card typically has thousands of cores, allowing it to perform millions of hash calculations simultaneously. The speed of such operations is dozens to hundreds of times faster than that of CPUs. Ordinary computers, on the other hand, either rely on integrated graphics cards or have their CPUs handle all the calculations, resulting in significantly slower performance. Our algorithm involves multiple GPU servers working together to perform the same task. Additionally, techniques like dictionary-based filtering and masking help to narrow down the search range step by step. This is exactly where the difference lies between “performing the calculations yourself over several months” and “letting us handle it in just a few minutes”.

Therefore, every additional character in the password length, or every expansion of the character set, will significantly increase the difficulty of retrieval. On the other hand, using a faster file format or remembering more clues about the password can greatly reduce the time required. The calculator above has already quantified these factors—by entering the type of file you’re working with and the range of possible passwords, you can see how long it will take for your computer to process the data compared to our system. If the results seem discouraging, feel free to submit your file to us and let us handle it.