Key Forge
Generate API keys and passwords — or check one you already use — then look at the number that actually matters: how long an attacker would need. Entropy here is computed from the process that made the secret, not guessed from its characters.
20 characters
94 characters available
—
falls in under an hour against a fast hash. This figure is arithmetic from the generation process, not an estimate.
| Scenario | Average | Exhaustive |
|---|---|---|
| Login, strict rate limit10 attempts/sec — assumption, not a benchmark | ∞ | ∞ |
| Login, loose rate limit1,000 attempts/sec — assumption | ∞ | ∞ |
| Unthrottled endpoint (distributed)10⁴ attempts/sec from many sources — assumption | ∞ | ∞ |
| bcrypt cost 12 (1 GPU)derived: 2.13 × 10⁵ H/s @ cost 5 ÷ 2⁷ (hashcat, RTX 4090) | ∞ | ∞ |
| Unsalted SHA-256 (1 GPU)hashcat v7.0.0, RTX 4090: 22.1 GH/s | ∞ | ∞ |
| Unsalted MD5 (1 GPU)hashcat v7.0.0, RTX 4090: 163.4 GH/s | ∞ | ∞ |
“Average” is half the keyspace — an attacker stops once the secret is found. “Exhaustive” is the whole of it. The online rows are assumed attempt rates, not measurements; the offline rows are hashcat benchmarks on one RTX 4090, and an attacker with eight of them multiplies those figures by eight.
Entropy from the process
Length × log2(alphabet) is arithmetic, not opinion — which is why the figure for a generated secret is called exact, while the figure for a password you typed is always labelled an estimate.
The assumptions are printed, not buried
Every row of the table carries its own rate and says where it came from: which figures are assumptions, which are hashcat benchmarks, and on what hardware. The offline ones are one RTX 4090 — eight GPUs multiply them by eight.
Nothing is ever sent
Random bytes come from crypto.getRandomValues in your browser, never from Math.random. This page makes no network requests at all.