The processing power of computers is rapidly increasing. The current focus on AI has led to significant investments in GPUs and other specialized processors, with companies creating increasingly powerful systems for training large AI models.

This trend prompts an important question for cybersecurity experts: If interest in AI diminishes and this specialized hardware becomes underutilized, could it be used for password cracking? And, if so, does this mean that passwords will soon become ineffective?

To investigate this possibility, we compared the Nvidia H200 and AMD MI300X, two leading AI accelerators, to Nvidia’s best consumer GPU, the RTX 5090. Our aim was to determine if a costly AI GPU ($30,000) offers a real advantage in password cracking.

The Specops research team has previously published studies on the time required for attackers to crack hashed passwords using brute-force methods. In previous tests of MD5, bcrypt and SHA-256, we measured the cracking speed of each algorithm using identical hardware.

To assess the impact of GPUs on password cracking, we used Hashcat, a popular password recovery tool. Hashcat includes benchmarking features that show how quickly different hardware can process password hashes.

This is important because password cracking is essentially about trying many possibilities, meaning the more hashes a system can create, the more passwords it can test, and the faster it will find the right one.

For this comparison, we analyzed Hashcat benchmark results for five common hashing algorithms:

• MD5
• NTLM
• bcrypt
• SHA-256
• SHA-512

These algorithms are commonly used in Active Directory, including older, faster hashes easily cracked with brute force, and newer algorithms with stronger encryption.

This presents a realistic challenge for our three high-performance GPUs. Since these products have generally comparable performance within their categories, they are beneficial as reference points for comparing AI hardware designed for business with GPUs consumers can buy.

The most obvious finding is that the RTX 5090 generated hashes across all tested algorithms more rapidly than either AI accelerator. The RTX 5090 processed passwords at almost twice the speed of the H200 across several functions.

The difference in price-to-performance is significant. An H200 costs at least ten times as much as an RTX 5090, leading you to expect significantly better performance from the AI accelerator in a direct comparison, but that is not what we found.

Additionally, IBM created a password-cracking system in 2017 that used eight Nvidia GTX 1080s, which was the best consumer GPU at the time.

That system achieved an NTLM hash cracking rate of 334 GH/s, meaning that a consumer GPU setup from nine years ago provides similar or superior password-cracking performance as today’s leading AI accelerators.

Therefore, the answer to the question “Is a $30,000 GPU effective at password cracking?” is clearly no.

Password cracking doesn’t require highly specialized or expensive hardware. Professional crackers and attackers already have sufficient computing power to crack weak passwords. In our SHA-256 tests, a password using numbers, uppercase and lowercase letters, and symbols could be cracked in approximately 21 hours.

This illustrates why strong passwords are vital, and the best defense is length. A 15-character password using that same mix of character types, hashed with SHA-256, could take an estimated 167 billion years to crack, even with strong GPU hardware. Brute-forcing becomes an unrealistic attack at that point.

A greater risk comes from passwords exposed in data breaches, often due to password reuse. While you might require employees to create strong, complex Active Directory passwords and store them securely,

that security is negated if users reuse those passwords on less secure personal devices, websites, or applications.

If hackers can link stolen logins to a specific person, it is frequently quite easy to determine where they’re employed and then attempt to use the same passwords to access company accounts. There’s an entire criminal market comprised of specialists who focus on gaining initial access to company systems from stolen passwords.

This underscores the importance of tools that can quickly identify compromised passwords within your organization. By detecting exposed credentials quickly, security teams can reset accounts and stop attacks before passwords can be used to gain unauthorized access.

Tools like Specops Password Policy provide advantages in two important areas:

• Granular password policy management: Our solution allows security teams to implement detailed password policies beyond Active Directory’s built-in capabilities. This includes support for passphrases and ready-made compliance templates to align your organization with required standards. Dynamic feedback helps users choose strong, memorable passwords while significantly increasing cracking difficulty.
• Continuous scanning for breached passwords: The Breached Password Protection feature continuously scans your Active Directory domain against a database of over 5 billion known compromised passwords, as well as those exposed on the dark web. Customizable messages alert users if their password has been compromised.

Ultimately, security strategies should not rely solely on passwords. Multi-factor authentication (MFA) offers another line of defense, securing accounts even if a password is compromised.

Specops Secure Access adds a security layer to Windows Logon, RDP, and VPN connections.

If you’re interested in learning how Specops can bolster your Active Directory against credential attacks, contact us today.

Sponsored and written by Specops Software.