Now on Demand: Threat Detection and Incident Response (TDIR) Summit - All Sessions Available
Connect with us

Hi, what are you looking for?


Data Protection

New Password Cracking Analysis Targets Bcrypt

Hive Systems conducts another study on cracking passwords via brute-force attacks, but it’s no longer targeting MD5.

Cybersecurity firm Hive Systems has released the results of its latest annual analysis on cracking passwords through brute-force attacks.

Hive has been conducting this study for several years and until now it has targeted passwords hashed with the widely used MD5 algorithm. However, MD5 hashes can in many cases be easily cracked and organizations have increasingly turned to more secure algorithms, particularly Bcrypt.

Bcrypt is not the most secure, but based on data collected by Hive from the Have I Been Pwned breach notification service it has been the most widely used in recent years. 

That is why Hive has decided to conduct its testing against Bcrypt password hashes, using a dozen NVIDIA GeForce RTX 4090 GPUs.

The tests showed that any password under seven characters can be cracked within hours. In last year’s tests, weak 11-character passwords were cracked instantly using brute force attacks. With Bcrypt, the same 11-character password now takes 10 hours to crack. 

Hive’s analysis showed that strong passwords (containing numbers, uppercase and lowercase letters, and symbols) and fairly strong passwords (containing uppercase and lowercase letters) are difficult to crack if they are more than eight characters long — it takes months or years to crack such passwords if they are protected with Bcrypt.

Hive’s study assumes that the attacker has obtained a hash associated with a randomly generated password and attempts to crack it.

“Non-randomly generated passwords are much easier and faster to crack because humans are fairly predictable. As such, the time frames in these tables serve as a ‘best case’ reference point. Passwords that have not been randomly generated would be cracked significantly faster,” the company explained.

Related: AnyDesk Hacked: Revokes Passwords, Certificates in Response

Related: List Containing Millions of Credentials Distributed on Hacking Forum, but Passwords Old

Advertisement. Scroll to continue reading.

Related: CISA Urges Manufacturers to Eliminate Default Passwords After Recent ICS Attacks

Related: PoC Tool Exploits Unpatched KeePass Vulnerability to Retrieve Master Passwords

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.


Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.


SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.


People on the Move

Wendy Zheng named as CFO and Joe Diamond as CMO at cyber asset management firm Axonius.

Intelligent document processing company ABBYY has hired Clayton C. Peddy as CISO.

Digital executive protection services provider BlackCloak has appointed Ryan Black as CISO.

More People On The Move

Expert Insights