Is your WAC?Can it handle powerful GPUs? Hive Systems tested how quickly different types of Nvidia graphics cards can crack passwords, from GeForce RTX to A100 GPUs.

Today is World Password Day and you can find many lists of tips on how to create a perfect password on the Internet. But even if you follow the rules of technology, you can still fall victim to the cat if an attacker has very powerful hardware. Hive Systems has tested how well various GPUs from Nvidia’s stable can handle increasingly complex passwords.

The experiment was carried out under very specific conditions, so the generalizability of the results should be treated with caution. Hive Systems bases its visibility on hashes of passwords. If you are someone who doesn’t take the rules very seriously and protects your account with a “password”, it is stored on a server as a series of random numbers and letters.

Hackers who crack a server can attempt to decrypt your password using these hashes. Powerful GPUs can speed up this process by increasing the speed at which arbitrary combinations can be attempted.

Password cracked

If your password is all numbers, a hacker only needs a gaming PC with an Nvidia GeForce RTX 2080 to crack it in no time. Even passwords that only consist of letters are not particularly secure, as the following table shows.

The combination of letters, numbers and symbols systematically increases the time it takes to crack passwords. However, a password with eight different characters can also be cracked in less than an hour by an Nvidia GeForce 4090, Nvidia’s flagship GPU for the gaming market. An arsenal of A100 GPUs could complete this task in 19 minutes or even a second.

The story changes completely when the bcrypt protocol is activated to encrypt hashes. Then even the most powerful gaming GPU would take 99 years to crack a complex eight-digit password. With just ten thousand A100 GPUs, it would only take a hacker a few days.

Enable MFA

As mentioned above, you should consider the results of this experiment in its specific context. It is unrealistic for a hacker gang to have ten thousand A100 GPUs. That’s roughly the amount of computing power required to run ChatGPT. The most realistic scenario is that hackers have gaming GPUs and are theoretically able to crack passwords.

Another observation is that the experiment assumes that hackers have the hashes of passwords, which is not always the case. Hackers usually try to get your password using phishing techniques or they just guess it at random brute force-attack. Then a powerful GPU can certainly help, but you can best protect yourself against this with longer passphrases consisting of different characters.

To be on the safe side, always contact MFA. This gives you another floor behind the door, even if your password becomes public. The best tip you can get on World Password Day is to not rely solely on passwords.