I Built a GPU Password Cracking Simulator to Show How Passwords Get Attacked
I'd read the theory behind password cracking dozens of times — brute force, search space, hash rates, GPU parallelism. I could explain it. What I couldn't do was actually see it: watch the search space explode as you add one more character, or watch a weak password fall in seconds while a slightly longer one pushes the estimate out to centuries.
So I built PasswordLab — an interactive simulator that visualizes how brute-force and dictionary attacks scale against a password, based on length, character set, and simulated hardware. This isn't a game in the same sense as a quiz or a scam-spotting challenge. It's closer to an interactive experiment: an educational tool for understanding attack math that's normally buried in spreadsheets and CLI output.
Why I Built This
Password security advice is everywhere, and most of it is a list of rules: use 12+ characters, mix cases, add symbols, don't reuse passwords. People follow the rules without ever seeing why they matter numerically. "Use a longer password" sounds like generic advice until you actually watch the estimated crack time jump from minutes to millennia because of two extra characters.
I wanted a tool where a learner could type in a password pattern, configure a simulated attack, and watch the math play out — turning an abstract concept like "search space" into something visual and immediate.
How the Simulator Works
You start by entering a password (or a pattern), then configure the simulated attack: attack type, character set, and simulated hardware. From there, PasswordLab visualizes how the attack would progress against that password.
Password Strength & Search Space
Every password represents a "search space" — the total number of possible combinations an attacker would need to try in a worst case. That number is determined by two things: how many characters are possible at each position (the character set) and how many positions there are (the length). The simulator shows this number growing in real time as you adjust either variable.
Hashing
Passwords aren't usually stored in plain text — they're run through a hashing algorithm that turns them into a fixed-length string. An attacker with stolen hashes can't reverse the hash directly; instead, they guess a candidate password, hash it, and check if the result matches. The simulator visualizes this guess-hash-compare loop so it's clear that "cracking" a hash means guessing correctly, not decrypting anything.
Brute Force vs Dictionary Attacks
A brute-force attack tries every possible combination within a character set and length range — slow, but guaranteed to eventually succeed. A dictionary attack instead tries known real words, common passwords, and leaked-password lists first, since most people don't choose truly random passwords. PasswordLab lets you simulate both, and the difference is usually dramatic: a "clever" password based on a real word can fall to a dictionary attack almost instantly, even if it would take a brute-force attack a long time.
Character Sets
Whether a password uses lowercase only, lowercase + numbers, or the full mix of uppercase, lowercase, numbers, and symbols massively changes the size of the search space at every position. The simulator lets you toggle character sets independently so you can see exactly how much each one contributes.
Hash Rate & CPU vs GPU
Hash rate is how many password guesses can be hashed and checked per second. CPUs process guesses more or less sequentially; GPUs are built for massive parallelism, so they can attempt vastly more guesses per second on algorithms that support it. The simulator lets you switch between simulated CPU and GPU hardware profiles so you can see how throwing more parallel compute at a weak password collapses the estimated crack time — and why that same jump matters far less against a well-chosen long password.
Why Password Length Matters
Because search space grows exponentially with length, each additional character multiplies the total number of guesses required — it doesn't just add to it. This is the single biggest lever in password strength, and it's the effect the simulator is best at making visible: watching the crack-time estimate jump by orders of magnitude from adding just one or two characters.
Why Complexity Matters (and Where It Falls Short)
Adding character types (uppercase, numbers, symbols) also grows the search space, but it has a ceiling that length doesn't — and complexity rules often push people toward predictable patterns (capitalize the first letter, add "!" at the end) that a dictionary or rule-based attack accounts for anyway. The simulator makes this tradeoff visible: a long passphrase of lowercase words can outperform a short "complex" password against both brute-force and dictionary attacks.
Salting
A salt is random data added to a password before hashing, unique per user, so that identical passwords produce different hashes and an attacker can't crack many accounts at once using a single precomputed table. PasswordLab includes a salting toggle so you can see how it defeats precomputation-based shortcuts like rainbow tables, even though it doesn't change the raw brute-force math against one individual hash.
Offline Password Attacks
Everything simulated here models an offline attack — one where an attacker already has stolen password hashes and can guess against them locally, without rate limits, lockouts, or network delay. That's a very different threat model from someone guessing your password through a login form, and it's exactly why breached hash databases are so dangerous: offline, the only real defense left is how strong the password (and its hashing) was to begin with.
Watching the Attack Run
Once you start a simulated attack, PasswordLab animates the guess-hash-compare loop, ticking through candidate passwords and showing simulated hashes being generated and checked against the target. It's the same underlying concept as watching a real cracking tool's terminal output — guesses per second, current candidate, progress through the search space — just visualized instead of scrolling text.
(Illustrative example only — actual candidates, ordering, and timing depend on the attack type and configuration you choose in the simulator.)
Results & Comparing Passwords
At the end of a simulated run, you get an estimated crack time, the size of the search space that was searched, and the simulated hash rate used. It's a concrete number attached to an abstract idea — instead of "use a strong password," you get "this specific password, against this specific simulated attack, would take this long."
The comparison view is where the concept really lands. Put a weak password and a strong one side by side under the same simulated attack, and the gap in estimated crack time isn't a small difference — it's routinely the difference between instant and effectively never, within the simulation's model.
| Password Pattern | Character Set | Relative Simulated Search Space |
|---|---|---|
| 6 lowercase letters | 26 | Smallest |
| 8 lowercase + numbers | 36 | Larger |
| 10 mixed-case + numbers | 62 | Much larger |
| 16-character passphrase | 26 (words) | Largest, by a wide margin |
Illustrative comparison of how search space scales with length and character set — exact figures depend on your configuration inside the simulator.
I'd known for years that "add a character" mattered more than "add a symbol," but building this tool and watching the estimated time jump by orders of magnitude for a single extra character made it click in a way the theory never had. That's really the whole goal of PasswordLab — not to tell you password rules, but to let you watch why they're true.
What This Teaches
Core Takeaways From Using the Simulator
- Length beats complexity: A longer, simpler passphrase usually outperforms a shorter password stuffed with symbols.
- Dictionary attacks punish predictability: Real words and common patterns fall fast, no matter how "clever" they feel.
- Hardware parallelism matters enormously against weak passwords: GPUs dramatically shrink crack times for small search spaces, but that advantage shrinks in relative impact as search space grows.
- Salting stops mass cracking, not targeted cracking: It defeats precomputed tables across many accounts, but doesn't change the raw math against one specific hash.
- Offline attacks remove your usual defenses: No lockouts, no rate limits — once hashes are stolen, password strength is the last line of defense.
Type in a password pattern, configure an attack, and watch the search space collapse or explode in real time.
Open PasswordLabWhat's Next
I'm planning to add more hashing algorithm profiles and a rule-based attack mode (simulating common password-mangling rules like capitalizing the first letter or appending numbers) so the dictionary-attack comparison gets even more realistic. If there's a concept you think the simulator explains poorly, or a hardware/algorithm profile you'd want to see added, I'd like to hear it.
0 Comments