museum@crypto:~$ PASSWORD CRACKING LAB

Worker WebGPU is preferred. If it cannot initialize, the lab independently tries the main thread while preparing candidates in a dedicated worker.

Main-thread WebGPU API

Worker WebGPU API

Selected execution path

Reported adapter

Worker check

Main-thread check

A browser-wide “hardware accelerated” status does not guarantee that this page receives an adapter. Browser, platform and driver restrictions can still prevent access. No unsafe flags or software acceleration are enabled by this page.

If the API exists but every adapter request returns null: in Chrome inspect chrome://gpu, especially WebGPU, Vulkan and “Problems Detected”. The lab cannot bypass a browser restriction.

Configured search space

—

Estimated full search

—

CPU · candidates/s

—

GPU · candidates/s

—

Confirmed CPU checks

—

Confirmed GPU checks

—

Measured calibration candidates

—

Measured calibration time

—

Active GPU execution path:

CPU and GPU share one exact index ledger. Every assigned range belongs to one engine. Counts include whole completed batches; unfinished ranges are never reported as checked.

The estimate describes the full configured search, not the moment a match will appear. The original password never determines search priority. A match may arrive early, or never. Rates come from actual completed work.

German · base entries

German · words / entries

German · word pairs

German · unique transformed bases

English · base entries

English · words / entries

English · word pairs

English · unique transformed bases

Passwords & IT · base entries

Passwords & IT · words / entries

Passwords & IT · word pairs

Passwords & IT · unique transformed bases

The German dictionary retains the teaching words and adds 210,000 selected enz/german-wordlist entries (CC0), plus curated everyday, colloquial and computing terms. Existing entries remain. Source selection favours short words: ASCII transliteration, 1–20 letters, ordered by length then alphabetically. English expands the existing US Hunspell vocabulary with licensed ESDB 2026.02.25 vocabulary through level 80 (US/GB/Canada) and curated terms; this broad collection also includes less frequent valid words.

“Common passwords & IT” retains the existing public SecLists test list and adds curated computing, hobby, vehicle and pop-culture terms, plus 15,000 first names from aggregated US SSA name statistics. Selected familiar multiword names receive explicit joined spellings, without arbitrary name combinations. No new leaked credentials were imported. This is not a current popularity ranking; selection and ordering never depend on your password.

Fixed order: optional IT/Common → DE → EN; then years 1984–2035, one-digit and two-digit suffixes for selected lists, then optional Brute Force. Original, Title case, UPPERCASE and two fixed leetspeak forms remain. Each phase contains unique candidates. Overlapping collections and phases count as actual hash checks.

Brute Force fully enumerates all 95 printable ASCII characters over lengths 1–24. Dictionary bases contain at most 20 ASCII characters, reaching 24 with a year. Imported ä/ö/ü/ß use ae/oe/ue/ss; entered input is hashed exactly as UTF-8 and never normalized. Non-ASCII input remains outside the candidate space.

Larger lists increase coverage, loading cost and search time. Millions of words still cannot guarantee a match. Verified search time includes independent verification, but excludes calibration and pauses.

Years start at 1984 and end no earlier than 2035; thereafter the upper bound follows the calendar year (at most 9999). Compounds and famous names are not automatically hard to guess. A failed match does not prove security. Compressed word indexes are prepared once locally on load; workers receive only their bounded slice. This requires a current browser with gzip DecompressionStream support.

Sources and licenses: enz/german-wordlist · SCOWL/ESDB · SecLists · CC0 · SCOWL · MIT · Hunspell · ESDB 80 · SSA (Public domain) · Curated themes (CC0) · Metadata