Unfortunately, this chart is already out of date, the 2023 version looks like this: It is now the up to date chart.
This uses 12 RTX 4090 GPUs and MD5.
For the old chart you would need 40 billion guesses per second, and that is what the RTX 2080 was at five years ago. With a RTX 4090 you can guess 164 billion hashes per second.
Using 8 AWS A100 GPUs at $32.77/h you can guess over 520 billion times a second and then the chart looks like this:
All the charts and benchmark numbers are from here. There is way more on that page that I’m just going to leave out here, but I recommend you read through it.
Of course this isn’t quite accurate, this assumes the hashing algorithm MD5 which is no longer recommended, because it’s so fast. It also ignores salting. But it assumes the worst case, a complete brute force with no dictionary/rainbow table, so I think it’s not a bad estimate.
Edit: spelling
Edit again: The comment I was referring to is gone, so I removed the refrence. The numbers are still correct though.
Yes, this is what it looks like using bcrypt, and the same AWS GPUs:
But they also mention that most low priority logins that people don’t care about like forums, restaurants, etc. still use MD5, and password reuse becomes a huge problem here.
Unfortunately, this chart is already out of date, the 2023 version looks like this:It is now the up to date chart.For the old chart you would need 40 billion guesses per second, and that is what the RTX 2080 was at five years ago. With a RTX 4090 you can guess 164 billion hashes per second.
Using 8 AWS A100 GPUs at $32.77/h you can guess over 520 billion times a second and then the chart looks like this:
All the charts and benchmark numbers are from here. There is way more on that page that I’m just going to leave out here, but I recommend you read through it.
Of course this isn’t quite accurate, this assumes the hashing algorithm MD5 which is no longer recommended, because it’s so fast. It also ignores salting. But it assumes the worst case, a complete brute force with no dictionary/rainbow table, so I think it’s not a bad estimate.
Edit: spelling
Edit again: The comment I was referring to is gone, so I removed the refrence. The numbers are still correct though.
thanks for this, OP forgot to mention that it’s MD5 and i think that’s absolutely crucial
Yes, this is what it looks like using bcrypt, and the same AWS GPUs:
But they also mention that most low priority logins that people don’t care about like forums, restaurants, etc. still use MD5, and password reuse becomes a huge problem here.
Ohh, thanks. I updated it.