/ Research · Web security · November 2026
How long would it take to steal your password?
When a website's database gets stolen, what decides whether your password breaks in seconds or never breaks at all? I stored the same 20 passwords the four ways websites do and attacked them from a laptop. The result depends on the password and on how the website stores it, and the person signing up does not choose the second.
This is with the database already stolen. The attacker has the hashes on their own machine and guesses without limits. On a normal login page the site can slow guesses down, and that is a different scenario: this page is not saying someone can guess your Instagram from the sign-in screen. The exact commands and the hashes are not here either.
/ Summary
The numbers
/ 01 · Signing up
What happens to your password when you sign up
A well-built website does not keep your password. It keeps a hash: the result of running it through a formula that cannot be reversed. It takes five steps.
- 1
You type the password
Into the form. It travels to the server encrypted over HTTPS.
- 2
The server generates a salt
A random value, different for each user.
- 3
It runs it through the formula
Password and salt, at whatever cost the developer chose. This step sets what each guess costs.
- 4
It stores a single line
Algorithm, cost, salt and hash together. bcrypt at cost 12 starts with
$2y$12$; Argon2id spells out its settings:$argon2id$v=19$m=47104,t=1,p=1$. - 5
It forgets the password
When you come back, it repeats the sum with the stored salt and compares. If it matches, you are in.
Whoever steals the database takes those lines. They do not see your password: they have to guess it, hash each guess and compare. What each guess costs them was decided by the website in step 3.
A different scenario
Normal login
- The attacker guesses through the site's form, one at a time.
- The site can stop them: attempt limits, temporary lockouts, a second factor.
- What decides it: those defences, and your password not being one of the most common.
What this test measures
Stolen database
- The attacker has the hashes on their own machine and needs no one's permission.
- There is no attempt limit, and a second factor does not help.
- What decides it: how the password was stored, and how predictable it is.
/ 02 · The four methods
What each storage method is
All four methods in the test produce a hash, but they were built for different jobs.
| Method | What it is | What it was built for | Fit for passwords? |
|---|---|---|---|
| MD5 | A 128-bit digest from 1992. Very fast to compute. | Checking that a file has not changed, like a fingerprint. It is broken even for that today. | No. It is fast on purpose. |
| SHA-256 | A 256-bit digest from the SHA-2 family (2001). Fast, and sound as a fingerprint. | Digital signatures, TLS certificates, file integrity. | Not on its own. It is fast on purpose too. |
| bcrypt | A 1999 formula made for passwords. It is salted and has a cost: each step of cost doubles the work. Cost 12 means 4,096 repetitions. | Storing passwords. | Yes. OWASP asks for cost 10 at least. |
| Argon2id | The winner of the 2015 Password Hashing Competition. Salted, and it demands memory on top of time for every guess. | Storing passwords, including against graphics cards. | Yes. It is OWASP's first choice. |
A salt means two people with the same password end up with different hashes, so the attacker cannot crack them both at once. In the test, MD5 and SHA-256 were unsalted, as on many older sites.
/ 03 · Speed
The same attack, at four speeds
How many guesses a second the attacker gets depends only on the method the website picked. These are the top speeds measured on the same laptop.
| How the site stores it | Guesses per second | Slower than MD5 | What MD5 tries in 1 s |
|---|---|---|---|
| MD5 | 11,351,300,000 | Baseline | 1 s |
| SHA-256 | 2,878,100,000 | 3.9× | 3.9 s |
| Argon2id | 2,478 | 4.6 million× | 53 days |
| bcrypt | 317 | 35.8 million× | 414 days |
What MD5 tries in one second
bcrypt needs 414 days to try the same. Each grey square is one day.
Why the speeds come out like this
- MD5 and SHA-256 are short sums. A graphics card has thousands of small cores doing the same operation at once, and these formulas barely touch memory. That is how the RTX 4060 manages billions a second. SHA-256 runs about 3.9 times slower because its sum is longer.
- bcrypt is expensive on purpose. At cost 12 it repeats its setup 4,096 times and, all the way through, keeps reading and writing a 4 KB table. Graphics cards handle that kind of memory access badly: many of their cores sit waiting.
- Argon2id demands memory. Every guess needs 46 MiB. The laptop RTX 4060 has 8 GB, so at most about 170 guesses fit at once (a calculation). But with a single pass, each guess walks that memory once, and moving memory is exactly what a graphics card does fast.
Speeds measured during the attack, not taken from the tool benchmark. For MD5 and SHA-256 the top speed comes from the brute-force phase: in the dictionary phase the limit was reading the list from disk, about 500 million guesses a second. For bcrypt and Argon2id the hash itself is the limit in every phase. A machine with more or better cards would be faster; this test does not measure by how much.
/ 04 · The attack
What it was attacked with: a leaked list, combinations and brute force
An attacker does not guess at random. They start with passwords people have already used and leave character-by-character guessing for last. The test did the same, in this order and with the same pieces against all four methods:
- Phase 1: dictionary
rockyou
14,344,391 user passwords from a 2009 breach, public ever since. The base of almost any attack.
- Phase 1: dictionary
best66 rules
The usual tweaks to every rockyou word: capital first letter, letters for digits, suffixes.
- Phase 2: combinations
354 custom pieces
One Piece names, common English words, the years 1990 to 2026 and suffixes such as
!,123,@or404. - Phase 2: combinations
princeprocessor
Joins those pieces in twos and threes. It is what built CrazyCatLady.
- Phase 3: brute force
Mask
Character by character, about 20 minutes. Only against MD5 and SHA-256: bcrypt, at 317 a second, would not cover even 4 characters (a calculation).
None of the 20 passwords was in the list of 354 pieces, checked in code. The common ones could be in rockyou naturally, and that was exactly what I wanted to measure. CrazyCatLady was not on any list: the program built it by joining crazy, cat and lady.
/ 05 · The 20
The 20 passwords, by group
None belongs to anyone. I picked them to test one idea per group. The ones in red fell. All 20 were stored all four ways.
| Group | Why | The passwords | Fell to MD5 and SHA-256 |
|---|---|---|---|
| Common | I expected them to fall at once. | ineedapasswordiforgotPleaseUseMe | 2 / 3 |
| Look strong | Capitals, symbols and numbers, all in a pattern. | ZoroGotLostAg@in!404SuuuuperRRRrr!77SniperKing=Usopp?100% | 0 / 3 |
| Internet jokes | I had no idea which way they would go. | FBISurveillanceVanCrazyCatLadyEarlyAlzheimersPorqueFi | 1 / 4 |
| Word phrases | I expected length to carry them. | memorysuckswhydoialwaysforgetNoOneHasntDoneXGopuLongHairedFreakyPeopleNeedNotApplyDiarrheaIsHereditary.ItRunsN1sJeans. | 0 / 5 |
| The absurdly long one | 68 characters. | IndianMilitaryCyberIntelligenceWing | 0 / 1 |
| Random | From a cryptographic generator: 8, 12, 16 and 20 characters. | nGA295h{xsor{lR=^yu=jR4(QY5GWgTS^Bm7j%=bQHxw{NTC0GE^^y1= | 0 / 4 |
/ 06 · What fell
What fell, and why
MD5 and SHA-256 lost the same three. bcrypt and Argon2id lost none, including the two that were in rockyou.
| Password | How it fell | MD5, at most | SHA-256, at most | bcrypt and Argon2id |
|---|---|---|---|---|
| ineedapassword | It was in rockyou as is, a public list of 14.3 million leaked passwords. | 7.2 s | 24.1 s | Held |
| iforgot | Also in rockyou. | 7.2 s | 24.1 s | Held |
| CrazyCatLady | Not in rockyou. A program built it by combining common words from a list: crazy, cat and lady. | 27.6 s | 45.1 s | Held |
Each time is the end of the phase in which the password fell, counted from the start of the attack: it fell within that time. With bcrypt and Argon2id the dictionary did not even finish within the 10 minutes per phase. At 317 guesses a second, going through rockyou and its variations would take up to about 35 days; at 2,478, about 4.
Three things I did not expect
- ZoroGotLostAg@in!404 held, even with MD5. It has capitals, symbols and numbers. CrazyCatLady, with no symbols, fell because it is three common words.
- PleaseUseMe looked common and held. It was not in rockyou, and the dictionary variations never reached it.
- PorqueFi held, and it is still weak. It has 8 characters, letters only. The test brute force reached 6 or 7 characters; trying letters only, MD5 would find it in about 1.3 hours (a calculation).
/ 07 · Configuration
The algorithm's configuration decides
Saying "this site uses bcrypt" or "it uses MD5" is not enough. What sets the price of each guess is the parameters it runs with: the cost, the memory, the passes, the salt.
Argon2id, the newer one, held less than bcrypt
With the test settings, bcrypt held about 8 times longer: 317 guesses a second, against 2,478 for Argon2id. Argon2id ran at the minimum OWASP recommends (46 MiB and one pass, the first option on its list). bcrypt ran above its own: cost 12, where the minimum is 10. Argon2id with more memory or more passes would be slower to attack, and bcrypt at cost 10 about 4 times faster (a calculation: each step of cost doubles the work). Raising the parameters has a price: the server takes longer on every login.
Not every "MD5" is the MD5 in this test
Up to version 6.7, WordPress used a scheme called phpass. Inside it is MD5, but salted and repeated 8,192 times. The name is the same, but it allows roughly 8,000 times fewer guesses a second. It is still thousands of times faster to attack than bcrypt at cost 12.
One bcrypt limit: it only uses the first 72 bytes of a password. The 68-character one in the test just fits. That is why WordPress 6.8 first condenses the password with SHA-384 and hands that to bcrypt.
/ 08 · In CMSs
How WordPress, Drupal and the rest store passwords
Most websites do not write this code: they inherit it from their content management system. This is how it has changed in the most used ones.
| CMS | Before | Now | Watch out for |
|---|---|---|---|
| WordPress | phpass (salted, repeated MD5), prefix $P$, up to 6.7. | Since 6.8 (April 2025), bcrypt after condensing with SHA-384, prefix $wp$2y$. Argon2id is opt-in. | Old hashes are redone on the next login. Users who never come back stay on $P$. |
| Drupal | MD5; from Drupal 7, phpass with SHA-512 ($S$). | bcrypt since Drupal 10. Argon2id is announced from Drupal 12. | Argon2id is an announced change for Drupal 12: check your version. |
| Joomla | Salted MD5. | bcrypt since Joomla 3.2 (2013). | Sites not updated in years. |
| Magento | Magento 1: salted MD5. | Argon2id when the server has the Sodium extension (PHP 7.3 or later). | Without Sodium it falls back to SHA-256 with a per-customer salt: a fast hash. |
| PrestaShop | md5(_COOKIE_KEY_ . password): one key for the whole shop. | 1.7 stores new passwords with bcrypt, but still accepts the old MD5. | Which one a given shop uses is only known by looking. |
How to tell what your site uses: look at a user's password column in the database. The first characters show the format.
$P$- phpass, older WordPress
$wp$2y$- WordPress 6.8 or later, bcrypt
$2y$or$2b$- bcrypt; the next number is the cost
$argon2id$- Argon2id, with memory (
m) and passes (t) written out $S$- Drupal 7
- 32 / 64 hex
- Hexadecimal and nothing else: MD5 or, at 64, probably SHA-256
On my own site, devilfruittcg.com, running WordPress: I checked, and it stores passwords with bcrypt.
The hash only comes into play once the database has been stolen. Other defences come first: keeping the CMS and plugins updated, since that is how databases usually get stolen; limiting login attempts, which WordPress does not do out of the box (a plugin or the proxy adds it); and a second factor on admin accounts.
/ 09 · The LastPass case
The same problem, in a password manager
In 2022, attackers stole backups of LastPass users' vaults. It was not a website with a table of hashes, but the failure is the one this test measures: how much work each guess costs.
- Each vault key comes from the master password through PBKDF2, which repeats a fast hash from the SHA family. The repetitions, which LastPass calls iterations, act as the cost.
- The default went up, but older accounts were not updated automatically. Some sat at 5,000, at 500 and even at 1.
- The saved website addresses were not encrypted. Passwords and notes were. The attacker could see which sites each entry belonged to and choose which vaults to attack first.
- LastPass spoke of "millions of years" to crack a master password. Analyst Wladimir Palant replied that this confuses pure brute force with a password a person chooses: on a single graphics card, a master password with 40 bits of entropy would fall in about two months, by his estimate.
LastPass default iterations
- At first
1 iteration
- June 2012
500
- February 2013
5,000
- February 2018
100,100without migrating old accounts
- OWASP, 2022
310,000 recommended
How it differs from this test: here bcrypt is compared with MD5 on a website; at LastPass it was PBKDF2 with few iterations in a password manager. The underlying problem is the same, a fast formula with little work per guess. And the same thing happens as with WordPress: raising the cost only protects the accounts that get migrated.
/ 10 · What to do
How to protect yourself better
If you have accounts on websites
- A different password for every site. If a site stores it with MD5 and gets breached, that password falls in seconds. If you use it elsewhere, every account falls with it.
- A password manager to keep them. That way each site gets its own random password and you do not have to memorise any. Make the master password long and used nowhere else: at LastPass, each vault key came from it.
- For the ones you memorise, a long phrase of your own, rather than something like P@ssw0rd!. Not built from pieces everyone uses.
- A second factor wherever you can. It does not save a stolen password, but it stops anyone logging in with the password alone.
If you build websites
- bcrypt or Argon2id, and check the parameters: they decide what each guess costs. The OWASP guide gives minimum values for each algorithm. MD5 and SHA-256 on their own are not fit for passwords.
- Rehash old hashes at login, as WordPress 6.8 does, and decide what happens to accounts that never come back.
- Limit login attempts and offer a second factor. That covers the other scenario, the sign-in screen.
- Look at the password column of your database at least once. It takes a minute.
/ 11 · Method
How it was measured, and its limits
- 20 passwords are not a sample. They were picked by hand to test ideas; the results describe these 20, not passwords in general.
- The same 20, stored all four ways with Python (hashlib, bcrypt and argon2-cffi): MD5 and SHA-256 unsalted, bcrypt at cost 12 and Argon2id with 46 MiB, 1 pass and 1 thread.
- A laptop with an RTX 4060 and hashcat 7.0.0. Speeds are the ones measured during the attack.
- Three phases per storage method: rockyou with the best66 rules; combinations from the 354-piece list with princeprocessor (none of the 20 was in it, checked in code); and mask brute force for MD5 and SHA-256 only.
- Limited time: about 20 minutes of brute force on MD5 and SHA-256 (21 and 25 minutes in practice), 10 minutes per phase on bcrypt and Argon2id. A password that did not fall means it did not fall in that time.
- The 35 and 4 days, the 1.4 million for phpass and the brute-force times are calculations, not measurements.
- The CMS and LastPass details come from the sources below and from Joomla's and PrestaShop's published code, not from this test.
Sources
/ Next
I check before I publish.
Every figure on this page comes from the attack logs and can be checked against the downloadable data. If your site stores passwords and you are not sure how, get in touch.