GeForce RTX 5090 cracks passwords up to twice as fast as the RTX 4090

Alfonso Maruccia

Posts: 1,722   +505
Staff
Cracking the Codes: A new Hive Systems Password Table update highlights a growing concern: modern GPUs can crack hashed passwords faster than ever. As hardware improves, short or simple credentials provide little to no defense – making longer, more complex passphrases increasingly vital for security.

Security company Hive Systems has been pushing the boundaries of password cracking using the latest GPU hardware since 2020. Its most recent Hive Systems Password Table update employs the GeForce RTX 5090 to boost cracking performance against hashed passwords substantially. Should users and companies be concerned? The answer isn't entirely cut-and-dry.

Hash functions convert text of any length into fixed-size values, turning a list of plaintext passwords into a cryptic hash table. Even if attackers steal this table from a server, there is no way to reverse the hash to reveal the original passwords.

Hackers can still try to crack hashed passwords by computing countless character combinations and comparing the results to known breached data – a method Hive Systems simulates in its yearly Password Table. For 2025, the analysts used twelve RTX 5090 GPUs to test their speed against the bcrypt hashing function.

Cracking an eight-digit password made of only numbers would take 15 minutes with the twelve GPU engine. Using just lowercase letters bumps the cracking time to three weeks. Reinforced credentials with numbers and letters, the timeline jumps to 62 years. Mix in symbols, and it balloons to 164 years of nonstop effort.

Compared to the GeForce RTX 4090, which Hive Systems used in its 2024 Password Table, Nvidia's latest GPU generation would provide a 33 percent performance increase. However, a single GeForce RTX 5090 would gain a significant edge with increasingly complex passwords, becoming twice as fast with passwords featuring numbers, uppercase and lowercase letters, and symbols. You would just need to wait 1,000 years to get the job done.

While these theoretical times are increasingly impractical, Hive's comparison to the GeForce RTX 4090, from last year's table, highlights how much more power hackers can tap into. Nvidia's latest GPU generation provides a 33-percent performance boost. However, the GeForce RTX 5090 has double the gain with increasingly complex passwords featuring numbers, uppercase and lowercase letters, and symbols. Humorously, that is the difference between 2,000 and 1,000 years.

Hive notes that cracking passwords this way still requires access to a database of compromised password hashes. The 2025 Hive Systems Password Table is an insightful reminder that complex, longer passwords are always safer than the typical weak passwords we see year after year. Please update your credentials, people.

Permalink to story:

 
Don't want to wait the 3 billion years to crack my passwords? I've got an exciting opportunity for you. Give me the 12x 5090s you were going to use to crack them, and I'll hand them over. (TFA credentials not included.)
 
One underrated takeaway: even with all this GPU firepower, a strong, unique password plus a solid hashing algorithm still buys you decades—or centuries—of protection. That’s pretty encouraging, as long as people actually use them.
 
Brute force password cracking isn't even a thing anymore, as any system worth anything will lock you out after maybe 3-5 tries. As for getting the hashes for passwords, that's pretty unlikely too, but even if they did get them, LastPass has me setup with 22 char pw's that use letters, numbers an symbols, so the universe will cease to exist before any of those are cracked. :)
 
Brute force password cracking isn't even a thing anymore, as any system worth anything will lock you out after maybe 3-5 tries. As for getting the hashes for passwords, that's pretty unlikely too, but even if they did get them, LastPass has me setup with 22 char pw's that use letters, numbers an symbols, so the universe will cease to exist before any of those are cracked. :)
Like said on article, if you can download password hashes some way, then you have endless available tries.
 
Back
OSZAR »