What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Some password hashes can be guessed extremely quickly with an RTX 4090, but the headline’s “under an hour” result was a specific offline test using eight RTX 4090 cards against an eight-character password space. It does not mean a graphics card can break into any online account in an hour. The hash algorithm, password choices, guessing method, and number of GPUs all matter.
What the RTX 4090 password-cracking headline means
Password cracking in these reports means offline guessing: an attacker has obtained password hashes and tests candidate passwords locally, comparing each candidate’s hash with the stolen one. The graphics card does not decrypt a password, and the guesses are not being submitted to a live login page.
The “under an hour” figure comes from Tom’s Hardware’s October 2022 report: eight RTX 4090 cards could test an eight-character password space in a reported 48 minutes in a brute-force scenario. That is a particular hardware-and-attack example, not a general estimate for all eight-character passwords. Tom’s Hardware’s report describes the setup.
What one RTX 4090 can do against salted MD5
Kaspersky’s 18 June 2024 analysis reports an RTX 4090 rate of 164 billion hashes per second against salted MD5 in its benchmark context. Using that rate, the report estimates that one card could enumerate roughly 2.8 trillion candidates in about 17 seconds for an eight-character space with 36 possibilities per position: same-case English letters and digits. The calculation assumes that candidate space and salted MD5; it does not establish a universal time to guess an eight-character password. Kaspersky Securelist explains its method and estimates.
#1 Best Overall
- 16,384 NVIDIA CUDA Cores
- Supports 4K 120Hz HDR, 8K 60Hz HDR and variable refresh rate as indicated in HDMI 2.1A
- New streaming multiprocessors: up to 2x power and power efficiency
- Fourth generation tensor cores: up to 2x AI power
- Third-generation RT cores: up to 2x ray tracing performance
That figure is broadly consistent with individual benchmark results, but benchmark rates are not interchangeable. A stock-clock Asus Strix RTX 4090 running Hashcat 6.2.6 recorded 164.1 GH/s for MD5 in a published benchmark artifact. A 2025 Hashcat 7.0.0 optimized benchmark on an ASUS TUF RTX 4090 reported 163.4 GH/s for MD5 and 271.9 GH/s for NTLM. Hashcat’s optimized kernels limit the maximum supported password length, so a benchmark result also depends on configuration. See the Hashcat 6.2.6 benchmark artifact and the Hashcat forum’s 2025 benchmark.
Why the hash type changes the time
A GPU’s guessing rate is specific to a hash algorithm and its settings. The enormous MD5 figure should not be applied to slower password-storage algorithms such as bcrypt. As historical examples, USENIX lists 2022 Hashcat RTX 4090 rates of 6.3 billion guesses per second for DES-crypt and 184 thousand per second for bcrypt at work factor 5. These are examples from a particular historical configuration, not current universal benchmarks; hardware, software, and settings differ. USENIX discusses the figures and comparability limits.
Rank #2
- TRI FROZR 3-Stay cool and quiet. MSI’s TRI FROZR 3 thermal design enhances heat dissipation all around the graphics card.
- TORX FAN 5.0-Fan blades linked by ring arcs and a fan cowl work together to stabilize and maintain high-pressure airflow.
- Copper Baseplate-Heat from the GPU and memory modules is captured by a copper baseplate and then rapidly transferred to Core Pipes.
- Core Pipe-Precision-machined heat pipes ensure max contact and spread heat along the full length of the heatsink.
- Airflow Control-Sections of different heatsink fins disrupt unwanted airflow harmonics and reduce noise.
Other factors change the result too: whether the attacker tests every possible combination or prioritizes dictionaries and familiar patterns, how many cards are working, and whether benchmark settings support the candidate length. A predictable word or sequence may be guessed earlier than a random password from the same nominal character space.
What Kaspersky’s 59% finding says—and does not say
Kaspersky analyzed 193 million passwords found freely accessible on dark-web sites. In its models, the best guessing method could guess 45% of that sample within one minute and 59% within one hour. Kaspersky describes the “best” method as hypothetical: it would require selecting the appropriate algorithm or running each algorithm on its own GPU. The percentages describe that collected sample and modeled method, not a representative survey of all current passwords or account holders. Kaspersky’s consumer overview also highlights reuse, meaningful words, names, and standard sequences as risks.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #3
- NVIDIA Ada Lovelace Streaming Multiprocessors: Up to 2x performance and energy efficiency
- Tensor Cores of the 4th Generation: up to 2x AI performance
- RT-cores of the 3rd Generation: up to 2x raytracing performance
- OC mode: Boost clock 2595 MHz (OC mode) / 2565 MHz (gaming mode)
- Axial Tech fans deliver up to 23% higher airflow
Does this mean an account can be hacked in an hour?
No. These figures concern offline guessing after hashes have been obtained. They do not show that an RTX 4090 can bypass login throttling, defeat multi-factor authentication, or submit unlimited guesses to a service. For an online login, the attacker faces the service’s authentication controls; the cited GPU benchmarks measure hash testing, not those controls.
How to make your passwords harder to guess
- Use unique passwords. A password reused across services can expose other accounts if one service’s credentials are compromised.
- Use a password manager to generate and store long, random passwords. This avoids relying on memorable words or predictable patterns.
- Avoid meaningful words, names, and standard sequences. Guessing strategies can prioritize familiar patterns rather than checking every possible combination.
Kaspersky’s analysis recommends unique, computer-generated passwords and password managers. The practical lesson is about reducing predictability and reuse—not buying a particular graphics card.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
