Researchers at Specops have updated their study on cracking passwords hashed with bcrypt. Two years earlier they published similar findings, but the hardware landscape has shifted dramatically since: the AI boom and surging compute demand have made high-end GPUs more affordable and accessible than ever.
This shift transcends gaming. Modern GPUs are repurposed to train large language models, and idle cycles are routinely rented out on platforms such as vast.ai. The same hardware can be redeployed for other tasks — including attacks against hashed passwords.
In the new experiment the team used a cluster of eight RTX 5090 cards — a configuration the researchers describe as the “practical minimum” for today’s adversaries. Renting comparable cloud capacity costs on the order of $5 per hour, rendering such attacks attainable even for small groups; larger rigs with 16 GPUs also appear on the market.
Unlike earlier measurements that relied on an antiquated bcrypt cost factor of 5, the Specops team tested with more realistic cost parameters of 10 and above. They generated 750,000 hashes derived from the real-world RockYou password corpus. Higher cost factors extend not only the cracking time but also the time required to produce the test corpus: building a dataset at cost 14 required nearly five hours on a powerful workstation.
The results are telling: an RTX 5090 is roughly 65% faster than its predecessor when handling bcrypt, yet increased hashing costs partially offset that advantage. Short, trivial passwords such as “123456” or “admin” remain trivial to crack, but long, complex passphrases — particularly those exceeding 12 characters — are effectively immune to brute force.
Timing data show a stark nonlinearity: very short passwords drawn from limited character sets fall almost instantly — four- or five-digit strings succumb immediately; six-character numeric or alphabetic passwords yield within minutes or hours. But an eight-character secret employing mixed case, digits, and symbols can push brute-force timelines to millennia. Once you reach 12 characters with the full complement of character classes, exhaustive search becomes infeasible within any practical horizon.
It is important to note that real attacks seldom rely on pure brute force. Adversaries more often use dictionaries, mangling rules, or targeted wordlists assembled from corporate footprints. Yet brute force provides a baseline metric of an attacker’s compute capability and underscores the protective value of length and entropy.
Specops stresses that hashing strength alone is not a panacea: if a password has already been exposed in a leak, bcrypt offers no salvation — the protection is nullified once the secret is compromised.
Consequently, the researchers recommend holistic password policies: a minimum length of at least 18 characters, mandatory use of multiple character classes, and support for long passphrases. Organizations should also maintain bespoke blocklists that forbid terms tied to the company — product names, brands and other obvious words — which can be generated using tools like CeWL against the organization’s public assets.
The study’s verdict is simple: cracking has become more attainable as hardware grows more potent, but robust defenses still work — provided users adopt long, unique, high-entropy passwords. In a world where GPUs can be rented for $5 an hour, entropy and length remain the cornerstones of password security.