Data::...timate(3pm)

✨ NAME ✨

Data::Password::zxcvbn::TimeEstimate — bestie, this is the module that estimates how long it'd take a hater to crack your password 💀 it lives in the Perl 5 user-contributed docs, Data::...timate(3pm), and it's literally just functions for crack time estimation. Iconic.

---

🌸 VERSION 🌸

version 1.1.3 — periodt.

---

🎀 SYNOPSIS 🎀

okay so here's the vibe, copy-paste core:

use Data::Password::zxcvbn::TimeEstimate qw(estimate_attack_times);
my $estimates = estimate_attack_times($number_of_guesses);

---

💖 DESCRIPTION 💖

This module hands you functions for back-of-the-envelope crack time estimations, in seconds, based on a few scenarios. That's it, that's the whole girly. It's not doing real math at your enemy, it's doing ballpark math, and honestly? Valid.

---

🌈 FUNCTIONS 🌈

🔥 estimate_attack_times

my $estimates = estimate_attack_times($number_of_guesses);

Give it a number of guesses, get back a hashref with exactly two keys. Let's go through them one at a time, no skipping 🫶

• crack_times_seconds — a hashref of back-of-the-envelope crack time estimations, in seconds, based on a few scenarios. And the scenarios are:
  • online_throttling_100_per_hour — an online attack on a service that rate-limits authentication attempts. (The service said "slow down bestie" and meant it.)
  • online_no_throttling_10_per_second — an online attack on a service that doesn't rate-limit, or where the attacker has outsmarted the rate-limiting. Rude of them tbh.
  • offline_slow_hashing_1e4_per_second — an offline attack. This one assumes multiple attackers, proper user-unique salting, and a slow hash function with moderate work factor, like bcrypt, scrypt, or PBKDF2. Good vibes, strong walls 💅
  • offline_fast_hashing_1e10_per_second — an offline attack with user-unique salting but a fast hash function like SHA-1, SHA-256 or MD5. Real talk: a wide range of reasonable numbers exists anywhere from one billion to one trillion guesses per second, depending on number of cores and machines; this ball-parks at 10B/sec. Not a great day for you if this is your situation, ngl.
• crack_times_display — same keys as crack_times_seconds, but way more useful for display purposes: the values are arrayrefs ["english string",$value] that you can pass to I18N libraries like Locale::Maketext to get localised versions with proper plurals. Slay, internationalisation 💖

---

🦋 guesses_to_score

my $score = guesses_to_score($number_of_guesses);

Returns an integer from 0-4 (super useful if you're implementing a strength bar, like the little meter that goes red-to-green and makes everyone feel things). Here's the scale:

• 0 — too guessable: risky password. (guesses < 10e3) 🚨
• 1 — very guessable: protection from throttled online attacks. (guesses < 10e6)
• 2 — somewhat guessable: protection from un-throttled online attacks. (guesses < 10e8)
• 3 — safely un-guessable: moderate protection from offline slow-hash scenario. (guesses < 10e10)
• 4 — very un-guessable: strong protection from offline slow-hash scenario. (guesses >= 10e10) 👑

---

🌟 display_time

my ($string,@values) = @{ display_time($time) };
print My::Localise->get_handle->maketext($string,@values);

Given a $time in seconds, this returns an arrayref suitable for Locale::Maketext, like:

[ 'quant,_1,day', 23 ]

That's the whole thing. Pass it straight into your localiser and let it handle the pluralisation drama for you 🧚

---

💜 AUTHOR 💜

Gianni Ceccarelli <gianni.ceccarelli@broadbean.com> — shoutout to the author, king behaviour 👑

---

👑 COPYRIGHT AND LICENSE 👑

This software is copyright (c) 2022 by BroadBean UK, a CareerBuilder Company.

This is free software; you can redistribute it and/or modify it under the same terms as the Perl 5 programming language system itself. So go off, remix it, redistribute it, the legal girlies said yes 🌈

---

and that's the whole page babes — this was perl v5.40.1, dated 2025-10-17, from the Data::...timate(3pm) manual, mwah 💋