The RTX 5090 is not only good for gaming and AI — it also excels at password cracking. Hive Systems updated its password cracking benchmark suite with 12 RTX 5090 graphics cards — Nvidia's fastest and best graphics card for gaming currently, and found all twelve cards working together can break simple eight-character passwords in under 15 minutes.
Hive Systems is in its 5th year of benchmarking password cracking times on GPUs; the last update they made was in 2024, featuring the RTX 4090. Rather than cracking an actual password itself, the outlet cracks hashes, which are scrambled versions of reproducible text generated by software.
Hashes are a popular method for securing customer passwords against hackers by storing customer passwords as hashes on servers. When hackers go to steal a password database from a company's server that is secured with hashing, all they will see are hashes of the passwords they represent rather than the actual passwords themselves.
Cracking passwords with this method involves making a list of all possible combinations of characters to make a password, then matching them to a stolen database featuring password hashes. Graphics cards are particularly good at this methodology due to highly parallelized computing capabilities.
With 12 RTX 5090s, Hive Systems found Nvidia's latest flagship can crack the hash equivalent of eight-character passwords featuring numbers only in just 15 minutes. Passwords comprised of eight lower-case letters, the dozen RTX 5090s were able to crack in 3 weeks.
On the other end of the spectrum, passwords taking advantage of numbers, upper and lowercase letters would take 12 RTX 5090s 62 years to crack, and 164 years to crack with symbols added into the mix.
For a generation-on-generation perspective, a single RTX 5090 can crack a numerical-only password hash with eight characters in three hours. A single RTX 4090 can accomplish the same task in four hours, representing a 33% performance improvement for the RTX 5090 over the RTX 4090 in this specific scenario.
However, as the password complexity increases, the RTX 5090 becomes faster and faster in comparison. Moving up to a hash representing an eight-character password made up of numbers, upper and lowercase letters combined with symbols, the RTX 5090 is allegedly twice as fast as the RTX 4090. But cracking a password that complex would take the RTX 5090 a millennium to accomplish.
Hive Systems' research demonstrates the dangers of low complexity passwords and how adding just a bit of complexity in the form of symbols, capitalized letters, and numbers can make a huge difference for security. The good news is that cracking hashes in the way Hive Systems demonstrates requires hackers to have a stolen database of password hashes in the first place. Without this, hackers can't brute-force hack password hashes.
