New NVIDIA GPUs Can Crack an 8-Digit Password in Just 3 Hours

Cybersecurity experts at Hive Systems ran tests to demonstrate how modern GPUs are reshaping password-cracking speeds. Their focus was NVIDIA’s latest flagship, the GeForce RTX 5090, which proved to be 33% more efficient at processing password hashes than its predecessor, the RTX 4090.

According to the findings, a single RTX 5090 can crack an 8-digit numeric PIN in about 3 hours. A rig outfitted with 12 of these cards can reduce that time to just 15 minutes. However, the time it takes to break a password rises dramatically with added complexity. For instance, an 8-character password made up solely of lowercase letters would take a single GPU around 8 months to crack — or 3 weeks using 12 cards.

Add uppercase letters and digits to the mix, and even a dozen RTX 5090s would need 62 years. Throw in special characters, and that figure jumps to 164 years. It’s a clear reminder of how adding even a bit of complexity can massively improve password security. It’s worth noting, though, that such brute-force attacks are only possible when hackers already have access to a database of stolen hashes. Without that, cracking passwords by brute force isn’t feasible.

Hive Systems’ research is part of an annual initiative evaluating the risks associated with weak passwords. In 2024, tests with the RTX 4090 had already revealed vulnerabilities in simple combinations — but the newest generation of GPUs accelerates the threat even further. The RTX 5090, for example, is twice as fast as the 4090 when processing complex character sets, though cracking strong passwords still takes significant time.

Experts stress that password length and character diversity remain the cornerstones of digital security. Even small changes to a password’s structure can drastically boost its resilience against automated attacks.