How the estimate is made
The number of possible combinations is (character set size) ^ (password length). The average time for a brute-force attacker to find the password is half that total, divided by the attempts-per-second rate.
Attempts rate — a theoretical value
The suggested default (1 billion attempts/second) represents an offline attack with specialized hardware (GPUs) against a fast, poorly protected hash. Properly protected systems (slow hashing like bcrypt/Argon2, rate limiting) drastically reduce that rate — sometimes to just a few attempts per second.
Is this a security guarantee?
No. It's a simplified theoretical estimate that ignores smarter attacks than pure brute force (dictionaries, common patterns, real leaked passwords) — which are usually much faster than the worst case calculated here.
Frequently asked questions
Why can an 8-character password be cracked so fast?
Because the number of combinations grows exponentially with length, not with the character set size — every extra character multiplies the time needed.
Does length or character variety matter more?
Length has a bigger exponential impact. A long password with only lowercase letters is usually stronger than a short one with every character type.
Does this estimate apply to any system?
No — well-protected systems (rate limiting, slow hashing, two-factor authentication) make brute-force attacks impractical, regardless of the theoretical result here.