$30,000 GPU Password Cracking Test: Results
▼ Summary
– The article tests whether expensive AI accelerator GPUs are superior to consumer GPUs for password cracking, comparing the Nvidia H200, AMD MI300X, and Nvidia RTX 5090.
– In benchmark tests across five hashing algorithms, the consumer-grade RTX 5090 outperformed both high-end AI accelerators in raw password hash generation speed.
– The results show password cracking does not require specialized AI hardware, as even a nine-year-old consumer GPU rig can match the performance of current flagship AI accelerators.
– The real organizational risk is from breached passwords reused across accounts, not from attackers using advanced hardware to brute-force strong passwords.
– The article promotes using tools like Specops Password Policy to enforce strong, unique passwords and scan for compromised credentials, alongside multi-factor authentication.
The rapid advancement of computing power, particularly driven by the demand for AI hardware, presents a significant question for cybersecurity. As vendors develop increasingly powerful GPUs and specialized accelerators for training large models, a potential future scenario emerges. Should the demand for AI computing recede, this high-performance hardware could be repurposed, raising concerns about its potential use for password cracking. To investigate this, a recent test pitted two flagship AI accelerators, the Nvidia H200 and AMD MI300X, against Nvidia’s top-tier consumer GPU, the RTX 5090. The objective was to determine if a $30,000 AI GPU holds a meaningful advantage in this specific security context.
The test methodology utilized Hashcat, a widely adopted password recovery tool with benchmarking capabilities. By measuring how quickly different hardware can compute password hashes, the test provides insight into brute-force attack potential. Five common hashing algorithms were evaluated: MD5, NTLM, bcrypt, SHA-256, and SHA-512. These represent a realistic spectrum from older, faster hashes to modern, more cryptographically robust ones, offering a solid basis for comparing the three high-end GPUs.
The results were revealing. Across every algorithm, the consumer-grade RTX 5090 outperformed both AI accelerators in raw hash generation speed. In many functions, it processed passwords at nearly double the rate of the Nvidia H200. This performance gap is especially striking given the immense price difference; a single H200 costs at least ten times more than an RTX 5090. The data suggests that for password cracking, exotic AI hardware does not provide a superior return on investment.
This point is further emphasized by historical context. A password-cracking system built in 2017 using eight Nvidia GTX 1080 consumer GPUs achieved an NTLM hash rate of 334 GH/s. That nine-year-old rig delivers performance comparable to, or even better than, today’s flagship AI accelerators in this specific task. The conclusion is straightforward: a $30,000 GPU is not particularly effective for password cracking when measured against modern consumer alternatives.
The real organizational risk lies elsewhere. Attackers do not require specialized, expensive hardware to execute successful brute-force attacks. Existing consumer-grade computing power is more than sufficient to compromise weak passwords. For instance, testing showed that a password using numbers, upper and lowercase letters, and symbols, when hashed with SHA-256, could be cracked in approximately 21 hours. This underscores the critical importance of enforcing stronger passwords, where length is the most effective defense. A 15-character password with the same complexity would take an estimated 167 billion years to crack with current GPU technology, rendering brute-force attempts impractical.
A more immediate and prevalent threat comes from compromised passwords exposed in data breaches, often due to password reuse. An organization may enforce strong, complex passwords within its Active Directory, but that protection is nullified if an employee reuses that credential on a less secure personal website or application. Attackers and initial access brokers actively trade and leverage these exposed credentials to target corporate accounts, making it vital for security teams to detect and remediate them proactively.
Effective defense requires a layered approach. Granular password policy management allows organizations to implement rules that exceed native Active Directory capabilities, supporting passphrases and providing dynamic user feedback to create strong, memorable passwords. Equally important is continuous scanning for breached passwords, checking credentials against a vast, updated database of known compromises to force resets before attackers can leverage them.
Ultimately, passwords alone should not be the sole line of defense. Implementing multi-factor authentication (MFA) adds a critical security barrier, protecting accounts even if a password is eventually recovered. This layered security model is essential for hardening defenses against the evolving landscape of credential-based attacks.
(Source: BleepingComputer)
