How long this password survives under four realistic attack scenarios.
Understanding these scenarios
Online, throttled — a login form that locks out or slows down after failed attempts (~100 guesses/hour). Most well-built sites work this way.
Online, no throttling — a login form with no rate limiting (~10 guesses/second).
Offline, slow hash — the password database was stolen, but passwords were hashed properly with bcrypt/scrypt/Argon2 (~10,000 guesses/second on modern hardware).
Offline, fast hash — the database was stolen and passwords were hashed weakly (MD5/SHA-1, unsalted) — crackable at billions of guesses/second on consumer GPUs.
mrpanos.com