With Password Recovery Bundle 2014 I didn't, couldn't make an effort to get something up right away -- I didn't feel too badly because early on someone posted about it's poor performance. They were accurate. I did find that you could add to or replace their dictionary, & that if you use the software against a plain, encrypted zip file using a word in that dictionary as your password, it works, fast. It does not appear to mutate the words in the list, nor will it work with a zip file using AES-256 encryption, even when the password was included in the list. The good part is it's almost portable as-is, so if you kept it or uninstalled there was very little impact to your system.
---
A common perception from the download page comments:
"A computer, which can test 1 billion passwords per second, tests (60x60x24x365x1,000,000,000) 3,15
16 passwords per year. Wow!, what a number! If you bundle 1 million of these supercomputers (think of the energy costs!) you crack 3,15 22 passwords per year…
If you create a password from letters and numbers (a..z,A..Z,0..9) with a password length of 15 characters, you have a password with 2,82 26 possibilities. To crack these with the above mentioned supercomputerbundle, you’ll need roundabout 9 billion years. Longer passwords are only of hypothetical use…
So don’t worry about used kernel, processor speed or other minor details. A longer password CANNOT be cracked by brute force, not now and not in the next future by nobody."
:) Maybe - maybe not... :)
If you're talking about super computers, & I mean the real deal, no government is going to give you real figures on performance breaking passwords. If you're talking private individuals, they can rent time on Amazon's servers, each with access to one or more GPUs for faster computations. If you're thinking about criminal types, remember that they do not use their own credit card numbers -- such can be bought wholesale for ridiculously small sums.
Now math is math & people are people -- that's where the above calculations go awry. There is for practical matters no such thing as random, & people use weak passwords -- you can download millions of actual passwords to use in attempted matching. There may be billions of possibilities, but a few million actual passwords + software that can mutate them a bit narrows the field immensely. Whenever you hear about whatever site being hacked & passwords stolen, odds are very high that those passwords were encrypted. Odds are also extremely high that the unencrypted versions will be available almost immediately. Because the word lists + software works. I've included links to a couple of articles.
Now things like encrypted zip & 7zip files are a bit of a different animal than cracking site passwords... there's more work to be done -- you have to check the contents -- and there's no fame or glory involved so far less time devoted to developing solutions. Add that someone desperate to get their stuff back will pay more, and you have the makings for a decent pay-ware market. Despite it being designed to check site security, working with hashes, you can, assuming you don't mind the command line, use the community version of John The Ripper on zip files fairly easily, but there are warnings that you might get some false hits.
