Time2Crack

10 attack types modeled

1. Brute force — exhaustive search of all combinations. Source
2. Dictionary — testing ~14 billion known leaked credentials. Source
3. Hybrid — dictionary + hashcat mutation rules (~1,000 variants/word). Source
4. Mask — targets predictable human structures. Source
5. Rainbow table — instant lookup on unsalted hashes. Source
6. Credential stuffing — reuse of leaked credential pairs. Source
7. Password spraying — common passwords across many accounts. Source
8. Markov/probabilistic — prioritizes statistically likely sequences. Source
9. PCFG — models grammatical password structure. Source
10. Combinator — concatenates words from two dictionaries. Source

6 hashing algorithms compared

Hashcat speeds on 12× NVIDIA RTX 4090: MD5 ~2,000 GH/s, SHA-1 ~610 GH/s, SHA-256 ~272 GH/s, NTLM ~2,000 GH/s, bcrypt (cost 5) ~71 kH/s, Argon2id ~800 H/s.

Limitations

A state-level or cloud attacker could be 10–1,000× faster. Phishing, keyloggers, SIM swapping, and social engineering bypass password strength entirely.