“How long to crack it?” is a math question — here’s the math.

The two numbers that decide everything

1 · The search space — how many passwords a cracker must try. For a password of length n drawn from an alphabet of size a (26 lowercase letters, 62 letters+digits, 95 printable characters…), it’s roughly aⁿ. Every extra character multiplies the work by the alphabet size. Randomness matters just as much: a patterned password (“Test2008!”) sits inside a much smaller space than a random one of the same length.

2 · The guesses-per-second rate — set by the wallet’s key derivation settings. A low-round wallet.dat (reference ~68k iterations) allows thousands of guesses per second on one GPU; a high-round one (~267k) only hundreds to low thousands; a modern Ethereum scrypt keystore allows only around a hundred on the reference CPU. The full parameter table lives in when recovery is possible.

Realistic cracking times (order of magnitude)

Assumptions: a single high-end consumer GPU (RTX 4090-class) for the GPU rows, and the site’s measured reference rates for the slow formats. The two tables separate two very different situations: blind brute force (random password, full search space, no shortcuts) and a smart attack (wordlist + rules + masks built from your habits). Times are planning estimates, not benchmarks.

Blind brute force — the full search space, no shortcuts

Smart attack — strong memory clues collapse the space

Why scrypt rows are so much slower: the memory-hard KDF forces ~262,000 iterations (the geth/Web3 standard is N=2¹⁸; the suite’s reference test uses N=2¹⁷) plus large memory per guess, so the measured reference run on the 9950X CPU is around a hundred per second instead of thousands to tens of thousands on a wallet.dat. That’s why Ethereum keystores are among the harder common formats. Numbers are order-of-magnitude for planning; exact speeds vary with GPU, driver and attack type.

The measured numbers (not estimates)

Order-of-magnitude tables are fine for planning, but the open-source recovery community publishes actual measurements. The table below is taken from the official btcrecover benchmark suite (Ryzen 9 9950X CPU, RTX 5090 GPU, 2026 measurements) — these are real guesses-per-second figures, reproducible by anyone who runs the benchmark tool themselves:

Now translate those rates into consequences: a high-round wallet.dat (~267k, ~122 guesses/sec) is checked roughly 4× slower than a low-round one (~68k, ~472) — and an Ethereum scrypt keystore at ~96 guesses/sec is roughly 1.3× slower than that high-round row (and ~5× slower than the ~472/s low-round CPU run). Two passwords of identical length behind different rounds counts sit in completely different recovery universes. You can model your own case interactively with the password strength calculator, which runs these same measured rates.

Why “smart” attacks beat brute force by millions

Blind brute force over 10 characters of a full alphabet is ~10¹⁹ tries — already unrealistic for wallet formats: at the site’s own wallet.dat GPU rate of ~11,950 guesses/sec that is on the order of a hundred million years, not weeks. Smart attacks only work when memory clues collapse the search space far below full brute force. A token attack built from your memory changes the game: if you know the password was a name + year + symbol, a btcrecover token list collapses the space to plausible candidates — but the runtime is always candidate count ÷ your wallet’s measured rate. A billion candidates still means roughly 121 days at ~96 guesses/sec (Ethereum scrypt), ~161 days at ~72/s (BIP38), ~95 days at ~122/s (high-round wallet.dat on CPU) or ~23 hours even at ~11,950/s (low-round wallet.dat on GPU); only exceptional fast formats such as MultiBit Classic .key genuinely cover billions in minutes to hours. This is why reconstructing your habits is worth more than buying GPUs. See offline recovery tools for how token lists and masks work.

Everyday examples people actually hit

• “I always use my dog’s name + my birth year” (e.g. Luna1993). With that clue, this is crackable within hours to days on any format — the token list is tiny.
• “I generated it in a password manager, 16 chars, no idea”. Not crackable. Full stop.
• “Some mix I made up in 2021, I remember it had my initials”. Recoverable with memory work plus a token attack — the clue shrinks the space by orders of magnitude.
• An old wallet.dat with a low rounds count (the ~68k reference wallet). The same passwords crack about 4× faster than the ~267k row above, because each guess is 4× cheaper. Low-round old wallets are the classic success story.

What this means for your case

• Estimate your own space first. How long is the password, and how much do you remember about its construction? The diagnosis quiz gives a first verdict.
• Check your wallet’s era and format. An old wallet.dat cracks far faster than a modern keystore. Identify your wallet file, then read its encryption settings.
• Gather clues before buying anything. Token lists from your own memory beat hardware money. Rebuild the pattern.
• If you still need more GPU time, rent it. High-end cards go for roughly $0.20–$0.50/hour on cloud GPU marketplaces — far cheaper than buying one for a single case. Costs and the upload-safety rules are in the renting guide.
• If the math says no, trust the math. A random 16-character password is unreachable for anyone — no tool, no hardware and no helper changes that.

Sources & references

1. hashcat — example hashes (wallet formats & modes)
2. Bitcoin Wiki — wallet encryption