Brute Force Attack Time Estimator

Adding complexity increases $S$ linearly, but adding length increases $L$ exponentially. For example, adding one symbol to a 10-char password increases keyspace by a small factor, but making it 14 chars makes it billions of times harder to crack.

Online attacks target APIs that rate-limit logins, restricting speed to e.g. 10 H/s. Offline attacks happen when databases are leaked, letting attackers run cracking rigs directly on hashes at billions of keys per second.

KDF algorithms (like Scrypt, PBKDF2, Bcrypt, and Argon2) are deliberately slow. They raise the computation cost of checking keys, reducing an attacker's speed from billions of hashes per second to mere hundreds, saving user databases.