Högskolan i Skövde

Passwords remain the most common way to protect online accounts, yet fast legacy hashes such as MD5 make them dangerously easy to crack once a database is stolen. This study measures how four popular cracking techniques—brute force, dictionary, hybrid, and combo list perform against MD5 on modern hardware (RTX 3090 GPU, Ryzen 5800X CPU) virtualised under Proxmox. Then benchmark Hashcat and John the Ripper on both Linux and Windows guests, then compare time-to-crack for eleven test passwords that range from simple words to 20-character random strings. Results show hybrid and combo lists break common word-based passwords in milliseconds, while random 12-plus-character strings resist all attacks within a 24-hour window. The conclusion is that unsalted and salted MD5 is obsolete and recommend immediate migration to memory-hard functions such as Argon2id, paired with password managers or passphrase policies to balance usability and security.