- Twelve RTX 5090 GPUs can crack short (but complex) passwords in days
- Password complexity and length drastically increase time needed to brute force
- Real-world cracking could be faster than Hive Systems’ worst-case scenario estimates
Cybersecurity firm Hive Systems has published its latest password cracking chart for 2025, built around a simulated attack using 12 Nvidia RTX 5090 GPUs.
The takeaway? If your password is short, simple, and predictable, it won’t last long. But if you’re already using long, unique passwords with a mix of letters, numbers, and symbols, there’s little reason to panic.
The RTX 5090 is Nvidia’s most powerful gaming GPU yet, but in Hive Systems’ testing, it doubles as a password-cracking machine.
Longer is much better
A hash representing a six-character password made from numbers and lowercase letters could take just 14 days to crack using a brute force approach. Add complexity and length, though, and the timeline grows fast. For example, an 18-character password using lowercase letters, numbers, uppercase letters, and symbols would take roughly 463 quintillion years to break.
Hive’s research models a worst-case brute force attack scenario, where the hacker has already stolen a hashed password database and is using strong hardware to guess the correct hash. It doesn’t reflect more common attacks like phishing or password reuse exploits, but it highlights why short passwords remain a risk.
It’s worth pointing out, as PC Gamer notes, “passwords could be cracked much quicker than the numbers here indicate, as the software could stumble across the correct one earlier in the process.”
Bcrypt, the hashing algorithm Hive used in its test, is commonly used to scramble passwords before storing them. While it can’t be reversed directly, it can be guessed by generating hashes from millions or billions of possible combinations. That’s where GPUs excel. Parallel processing makes them ideal for password guessing at scale.
Hive also looked at what would happen if hackers had access to much more power, like the 20,000 Nvidia A100 GPUs used to train ChatGPT-4. Even then, an 18-character numbers-only password would still take hundreds of years to break.
So what’s the lesson here? Password length and character variety – especially symbols – still matter. And with consumer GPUs only getting faster, it’s a good time to use a password manager and stop relying on anything under 12 characters.
Leave a comment