Everything stays in your browser. No password is transmitted. The calculation is entirely local. The only external request is an anonymous leak check (5 first hash SHA-1 characters, never password).

Scientific sources

Time2Crack relies on academic research in cryptography, computer security and password force estimation. This page lists the scientific sources that validate our algorithms, assessment methods and calibrations.

Table of contents

Fast navigation

Section 1: Password Strength Estimate

Estimation of password strength

Wheeler, D.L. (2016). zxcvbn: Low-Budget Password Strength Estimate. In Proceedings of the 25th USENIX Security Symposium (pp. 157–173). USENIX Association. https://www.usenix.org/system/files/conference/usenixsecurity16/sec16 paper wheeler.pdf
Relevance: Founding methodology for the realistic estimate of password force. Wheeler (2016) states that entropy-based meters (NIST, OWASP) significantly overestimate safety. Time2Crack follows this approach: estimate the cost of the best known attack, not theoretical entropy.
Pasquini, D., Continuously, A., Durmuth, M., & Buscher, M. (2021). Reducing Bias in Modeling Real-World Password Strength for Tree-based Models. In Proceedings of the 30th USENIX Security Symposium (pp. 3007–3024). USENIX Association. https://arxiv.org/pdf/2105.14170.pdf
Relevance: Critical analysis of biases in password force models. Shows that dataset bias results. Time2Crack uses rockyou2021 (32.6M weighted passwords) to minimize this bias.
Section 2: Metrics Evaluation

Evaluation methods

Wang, D., & Ding, S. (2023). No Single Silver Bullet: Measuring the Accuracy of Password Strength Meters. In Proceedings of the 32nd USENIX Security Symposium (pp. 2575–2592). USENIX Association. https://www.usenix.org/system/files/sec23fall-prepub-291 wang-ding.pdf
Relevance: Major comparative study (USENIX 2023) of 12 password strength meters out of 14 real dataset. Determines that:
  • Weighted Spearman correlation ρ is the standard metric to evaluate accuracy
  • Scientific target: ρ > 0.85 for good calibration
  • No meter exists without compromise (zxcvbn: ρ=0.76, Hive Systems: ρ=0.68)
Time2Crack aims ρ > 0.80 overall.
Golla, M., & Dürmuth, M. (2018). On the Accuracy of Password Strength Meters. In Proceedings of the 25th ACM Conference on Computer and Communications Security (pp. 1567-1580). ACM. https://maximiliangolla.com/files/2018/papers/ccsf285-finalv3.pdf
Relevance: Systematic evaluation framework for password strength meters (2018). Recommend: Spearman correlation + Kullback-Leibler divergence for offline attacks. Time2Crack incorporates these two metrics.
Castelluccia, C., Durmuth, M., & Perito, D. (2017). Adaptive Password-Strength Meters from Markov Models. In Proceedings of the NDSS Symposium. Internet Society. https://www.ndss-symposium.org/wp-content/uploads/2017/09/06 3.pdf
Relevance: Introduces metric α-Guesswork (Gα) : proportion of passwords cracked with G attempts. Evaluate the practical safety of the model.
Section 3: Attack Models

Attack models

Ma, J., Yang, W., Luo, M., & Li, N. (2014). A Study of Probabilistic Password Models. In Proceedings of the 35th IEEE Symposium on Security and Privacy (pp. 689–704). IEEE. https://www.ieee-security.org/TC/SP2014/papers/A%20Study%20of%20Probabilistic%20Password%20Models.pdf
Relevance: Founding comparison of probabilistic models (Markov, PCFG, neural). Determines that attacks by combination of words are underestimated by naive formulas (row multiplication = false independence hypothesis). Time2Crack corrects this with rockyou empirical calibration.
Dürmuth, M., Brostoff, S., & Oprea, A. (2015). The Success of Web Applications despite the Difficulty of Password Creation Rules. In Proceedings of the 22nd NDSS Symposium. Internet Society. https://www.ndss-symposium.org/wp-content/uploads/2017/09/ndss2015 09-4 durhmuth paper.pdf
Ur, B., Alfayez, P. G., Bhamasamy, S. M., & ... Cranor, L. F. (2015). Design and Evaluation of a Data-Driven Password Meter. In Proceedings of the ACM SIGCHI Conference on Human Factors in Computing Systems (pp. 3775–3786). ACM. https://www.usenix.org/system/files/conference/usenixsecurity15/sec15-paper-ur.pdf
Section 4: Markov and PCFG

Markov and PCFG models

Weir, M., Aggarwal, S., Collins, M., & Stern, H. (2009). Testing Metrics for Password Creation Policies by Attaking Large Sets of Revealed Passwords. In Proceedings of the 17th ACM Conference on Computer and Communications Security (pp. 162–175). ACM. https://www.researchgate.net/publication/221614956
Relevance: Founding methodology of PCFG (Probabilistic Context-Free Grammar). Established:
  • Structure breakdown (L=letter, D=digit, S=symbol)
  • Skeleton threshold 20-50 to capture real structures
  • Validation on real datasets (LinkedIn, Yahoo, RockYou)
Time2Crack uses SKELETON THRESHOLD=100 (revision to decrease to 30-50).
Dürmuth, M., Freeman, D., & Yazan, B. (2014). Password Guessing with Neural Networks. In Proceedings of the 25th USENIX Security Symposium. USENIX Association. https://courses.csail.mit.edu/6.857/2017/project/13.pdf
Houshmand, S., & Aggarwal, S. (2015). Next Gen PCFG Password Cracking. In IEEE Transactions on Information Forensics and Security, 10(8), 1776–91. IEEE. https://ieeexplore.ieee.org/document/7098389
Relevance: Next-Gen PCFG expansion with performance improvements and accuracy. Valid approach PCFG on millions of passwords.
Narayanan, A., & Shmatikov, V. (2005). Fast Dictionary Attacks on Passwords Using Time-Space Tradeoff. In Proceedings of the 12th ACM Conference on Computer and Communications Security (pp. 364–372). ACM. https://www.usenix.org/legacy/event/sec05/tech/full papers/narayanan/narayanan.pdf
Relevance: Foundations of attacks by dictionary and groove tables. Sets that dictionary + mutations covers ~95% of passwords in practice.
Section 5: Calibration and Datasets

Calibration and dataset

Zhang, Y., Monrose, F., & Reiter, M. K. (2010). The Security of Modern Password Expiration: An Algorithmic Framework and Empirical Study. In Proceedings of the 17th ACM Conference on Computer and Communications Security (pp. 176–186). ACM. https://users.cs.jmu.edu/reiter/papers/10ccs.pdf
National Institute of Standards and Technology (NIST) (2024). SP 800-132: Password-Based Key Derivation Function (PBKDF2). U.S. Department of Commerce https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistsspecialpublication800-132.pdf
National Institute of Standards and Technology (NIST) (2024). SP 800-63-3: Digital Identity Guidelines - Authentication and Lifecycle Management. U.S. Department of Commerce https://pages.nist.gov/800-63-3/sp800-63b.html
Relevance: NIST recommendations for selecting passwords and hash algorithms. Established:
  • bcrypt, scrypt, PBKDF2, Argon2 as acceptable algorithms
  • MD5, SHA-1 unsalted are not acceptable (rainbow tables)
  • dictionaries of 100k+ recommended words for attacks
Hive Systems (2025). Hive Systems Password Table 2025. https://www.hivesystems.io/password-table
Relevance: Industrial benchmark reference with 12× RTX 4090 GPUs. Time2Crack uses this profile as a baseline "experienced attacker" (12 GPU cluster).
Sprengers, Mr. (2011). GPU-based Password Cracking (Master's Thesis) Radboud University Nijmegen. https://www.ru.nl/
Relevance: GPU speed study for hash cracking. Sets benchmarks for MD5, SHA-1, NTLM, bcrypt with modern GPU.
Section 6: Hash Rates

Hash speeds and benchmarks

Hashcat Project (2025). Hashcat - Advanced Password Recovery (Official Benchmarks v6.2.6). https://hashcat.net/hashcat/
Relevance: Official Hashcat Benchmarks on RTX 4090 for all hash algorithms. Time2Crack uses these numbers as single GPU speeds and multiplies them by 12 for the experienced profile.
Gosney, J. (2016). 8x Nvidia GTX 1080 Hashcat Benchmarks. GitHub Gist. https://gist.github.com/epixoip/
Relevance: First system to exceed 330 GH/s NTLM (8 GPU cluster). Validated by industry as a multi-GPU reference.
Amazon Web Services (2024). Amazon EC2 P4d Proceedings - GPU Computing. https://aws.amazon.com/ec2/e instance-types/p4/
Relevance: Commercial GPU infrastructure available (100-1000 GPU clusters). Time2Crack uses for professional profiling (~100 GPU).
Additional References

Additional references

Oechsle, D., Bauer, L., Grupe, J., & ... Durmuth, M. (2021). Towards a Rigorous Statistical Analysis of Empirical Password Dataset. arXiv preprint arXiv:2105.14170. https://arxiv.org/abs/2105.14170
Klebanov, S., & Malone, D. (2012). Investigating the Distribution of Password Choices. In Proceedings of the 21st International World Wide Web Conference (pp. 569–578). ACM. https://www.maths.tcd.ie/~dwmalone/p/www2012.pdf
Castelluccia, C., Durmuth, M., & Perito, D. (2015). Password Guessing via Neural Language Modeling. In IEEE Transactions on Information Forensics and Security, 10(6), 1285–1296. IEEE. https://link.springer.com/chapter/10.1007/978-3-030-30619-9 7
Asgharpour, F., Bardas, A. G., & Liu, D. (2017). Comparing and Combining Feel Analysis Methods. In Proceedings of the COLING (pp. 1637-1648). ACL.

Update: 17 April 2026

← Back to tool