Hashcat turns a graphics card into a password-cracking engine, and the card you pick decides whether an authorized audit finishes overnight or drags on for a week. The right choice isn’t the card with the most VRAM or the best frame rates. It is the one that computes the most guesses per second for the hash type you are attacking, and the three that matter most in real engagements are NTLM, WPA2 and bcrypt. Those three behave so differently that the fastest card for one is not always the best value for another.
Use this hardware only against systems you own or are explicitly authorized to test. Cracking someone else’s hashes is a crime in most jurisdictions, and the fact that a GPU makes it fast changes nothing about that. With that said, this guide ranks the best GPU for hashcat work by card and by price band, using published hashcat -b benchmark figures rather than marketing numbers, and we re-checked every price, listing and stock status in October 2026 during the ongoing GPU and memory shortage, so the picks reflect what you can actually buy today.
ComputingForGeeks is reader-supported. When you buy through links on this page we may earn an affiliate commission at no extra cost to you. As an Amazon Associate we earn from qualifying purchases.
Our top picks for a hashcat rig
Every pick below is tied to a published benchmark and a live listing. The detailed sections follow, but if you only want the verdict, here is where each tier wins.
Fastest card you can buy: ASUS TUF RTX 5090
The RTX 5090 is the throughput king, and it carries the price tag and power draw to match.
The RTX 5090 posts the top number on every hash mode we found published, around 324 GH/s on NTLM and 303 kH/s on bcrypt per card. It’s the one to buy when audit turnaround matters and budget doesn’t. Skip it if you crack only slow hashes, because a cheaper card gets close on bcrypt. Check the live price on Amazon.
Most hashes per dollar: ASUS ROG Strix RTX 3090
A used RTX 3090 is the cheapest honest way into real cracking throughput, and 24GB leaves room for other GPU work.
A used RTX 3090 still clears about 126 GH/s on NTLM, which is plenty for most wordlist and rule attacks, and it costs a fraction of a 5090. It’s the value pick for anyone building a first cracking box. Skip it if bcrypt is your bread and butter, because its 104 kH/s there is the weakest of the fast cards. Check the live price on Amazon.
Low-power entry: ASUS Dual RTX 5060 Ti 16GB
The RTX 5060 Ti 16GB is the current-generation card that is actually in stock, and it sips power next to the flagships.
This is the card for learning hashcat and running small jobs on a tight power budget. We have no published hashcat -b run for it, so we won’t invent a number, but its Blackwell core count puts it well below the 5090 and in the entry tier. Buy it to get started cheaply, not to chase throughput. Check the live price on Amazon.
Where these numbers come from
Honesty first, because a buyer guide is only as good as its sources. We did not rent a lab bench for this round, so none of the hashrates here are ours. Every figure in the table is a published hashcat -b benchmark, pulled in October 2026 from runs anyone can read. The main table uses one consistent source family so the cards are comparable: single-card results from OnlineHashCrack’s benchmark rigs, all run with optimized kernels. We cross-checked the flagship figures against Chick3nman’s widely cited single-card gists.
Two caveats you should carry into the table. Published runs span different hashcat releases, which the figures reflect, so treat small gaps between neighbours as noise rather than a verdict. And a single card in open air holds its clocks better than one packed into a dense mining frame, so a desktop 5090 can run a little above the rig figure we quote. If you want numbers for your exact card, driver and cooling, run the benchmark yourself. It takes a couple of minutes.
hashcat -b -m 1000
hashcat -b -m 22000
hashcat -b -m 3200Run it once per mode, because hashcat takes a single hash type at a time: NTLM is mode 1000, WPA2 is mode 22000 and bcrypt is mode 3200. Each run prints a Speed.#1 line per device. To sweep every supported algorithm in one pass instead, use hashcat -b --benchmark-all. If you’ve never set hashcat up, our walkthrough on password cracking with Hashcat and John on Kali covers the install and your first real attack.
Hashcat benchmarks by card: NTLM, WPA2 and bcrypt
The table ranks the cards with published figures from fastest to slowest on NTLM. Read it by column, not just by row, because the order changes with the hash. NTLM and WPA2 reward raw shader throughput, while bcrypt is deliberately cache-bound and punishes cards that lean on bandwidth alone.
| GPU | VRAM | NTLM | WPA2 | bcrypt | Price band (Oct 2026) |
|---|---|---|---|---|---|
| RTX 5090 | 32 GB | 323.8 GH/s | 3352 kH/s | 303.1 kH/s | ~$8,600 to $9,000, scarce |
| RTX 4090 | 24 GB | 254.0 GH/s | 2516 kH/s | 240.2 kH/s | ~$2,100 to $5,000, used |
| H100 PCIe | 80 GB | 153.6 GH/s | 1674 kH/s | 285.2 kH/s | rent, ~$2 to $3/hr |
| RTX 3090 | 24 GB | 126.4 GH/s | 1135 kH/s | 104.2 kH/s | ~$1,800 to $1,950, used |
| A100 SXM4 | 40 GB | 116.4 GH/s | 1108 kH/s | 139.9 kH/s | rent, ~$1 to $2/hr |
Notice how the H100 jumps the 3090 and even the 4090 on bcrypt while sitting below both on NTLM. That is the whole lesson of this table in one row. On fast, unsalted hashes the consumer flagships win on raw shaders, but on a slow, iterated scheme like bcrypt the data-center card’s cache and integer units pull ahead. The gap between the columns is enormous too: the same 5090 does hundreds of billions of NTLM guesses a second and only a few hundred thousand bcrypt guesses. Pick the card for the hash you actually face, not the headline number.
ASUS TUF RTX 5090: the fastest card you can buy
The RTX 5090 is the clear throughput king and the only consumer card that tops the chart on NTLM, WPA2 and bcrypt at once. Its 32 GB of GDDR7 isn’t the point for cracking, where even huge wordlists stream from disk, but the shader count and memory bandwidth are, and they translate directly into the roughly 324 GH/s NTLM figure in the table. On an engagement with a tight reporting deadline, that speed is the difference between a result and an apology.
Who it’s for: a team that runs audits for a living and needs the shortest possible runtime on fast hashes. Skip it if your targets are mostly bcrypt or Argon2, because the 5090’s lead there is real but far smaller, and the money is better spent on a second cheaper card. The 575 W board power is the catch most buyers miss. Budget a 1000 W supply with the right connector and plan your cooling before the card arrives, the same discipline our PSU guide for multi-GPU builds lays out.
Stock is the real obstacle. Through the 2026 shortage the 5090 trades well above its launch price and sells out in minutes, so expect a band around $8,600 and up rather than list price. Check the live price on Amazon before you commit, and compare it against the cloud rental maths further down.
ASUS ROG Strix RTX 3090: the most hashes per dollar
The RTX 3090 is the value anchor of this guide. At roughly 126 GH/s on NTLM it does about 40 percent of a 5090’s work for well under a quarter of the price on the used market, and that ratio is what makes it the right first card for a home lab or a small consultancy. The 24 GB of memory is generous for cracking and leaves room to run other GPU work on the same box when hashcat is idle, which is exactly the overlap we cover in the best GPU for local LLMs guide.
Who it’s for: anyone pricing their first serious rig, or adding a second card to split a keyspace. Skip it if bcrypt dominates your work, because its 104 kH/s there is the lowest of the fast cards and a 4090 or an H100 rental will pay for itself on long jobs. Buy used with care. A card that spent two years mining can have tired fans and thermal pads, so favour a three-fan model, check temperatures under a sustained run, and keep an eye on them with something like our GPU monitoring setup with DCGM and Grafana.
Used 3090 prices have crept back up during the shortage, so a clean card now sits around $1,800 to $1,950 rather than the bargain it was a year ago. Check the live price on Amazon, and watch our GPU price tracker if you can wait for a dip.
ASUS Dual RTX 5060 Ti 16GB: the low-power entry
Not everyone needs a space heater to learn hashcat. The RTX 5060 Ti 16GB draws around 180 W, runs on a modest supply, and is one of the few current-generation cards that’s genuinely in stock rather than scalped. It will not trouble the top of the table, and we’re not going to paste a hashrate we did not measure, but its Blackwell core count places it firmly in the entry tier, above the old budget cards and well below the 5090.
Who it’s for: students, people building a practice lab, and anyone who cracks the occasional hash rather than running audits full time. Skip it if throughput is the goal, because a used 3090 or 4090 will out-crack it comfortably for similar money on the second-hand market. Its honest role is the cheapest way to get a real, current GPU into the box and start running hashcat -b against your own targets. Check the live price on Amazon.
The RTX 4090 still sits in the sweet spot
The RTX 4090 is the card we would pick if you could reliably buy one. At 254 GH/s on NTLM and 240 kH/s on bcrypt it lands between the 3090 and the 5090 on both fast hashes and bcrypt, which makes it the best all-rounder of the three consumer cards. The problem is purely availability. It went end of life in 2024, and the listings that remain are mostly third-party sellers without a buy box, so we’re not linking one rather than send you to a listing you cannot trust.
If a 4090 with a real warranty and a legitimate seller crosses your path near used-3090 money, it is the better buy for mixed workloads. Otherwise the 3090 below it and the 5090 above it are the cards you can actually complete a checkout on today.
Rent an H100 or A100 before you buy one
Data-center cards rarely make sense to own for cracking, but they are worth renting for the right job. An H100 nearly matches a 5090 on bcrypt and beats every consumer card except the 5090 on that mode, and renting one costs a few dollars an hour instead of five figures up front. For a one-off bcrypt or slow-hash audit, that is the economical path, and it scales: spin up several cards, split the keyspace, tear them down when the job ends.
The maths is simple. A card that lists near $9,000 pays for itself against a $2.50 per hour rental only after roughly 3,600 hours of running, which is five months of continuous cracking. Most teams do not keep a GPU pegged that hard, so unless you crack daily, rent the big iron and own a cheaper card for everyday work. Cloud GPUs are easy to find by the hour on vast.ai, and if a used data-center card still tempts you, weigh it against our guide to used data-center GPUs first.
What actually sets your cracking speed
Before you spend, understand what moves the number, because the common assumptions are wrong for password cracking. These are the factors that decide how fast your jobs finish, in the order they matter.
- The hash type dwarfs the GPU. A 5090 does billions of NTLM guesses a second and only hundreds of thousands of bcrypt guesses, so the algorithm sets the scale and the card only scales within it.
- Shader count and clocks drive fast hashes. NTLM, MD5 and WPA2 reward raw compute, which is why the newest flagship leads every fast mode.
- VRAM capacity barely matters for cracking. Wordlists stream from disk and candidate generation is on the fly, so 12 GB cracks the same hashes as 32 GB. Buy VRAM for other work, not for hashcat.
- Sustained cooling beats peak clocks for long jobs. A card that throttles after ten minutes loses more than one with a lower boost that holds all night.
- Power and connectors gate the build. A 5090 needs a 1000 W supply and the correct 12V-2×6 cable, and a cheap or adapted connector is a fire risk under a sustained load.
That order explains the gaps in our table. It also explains why the mid-range Blackwell cards, the 5070 Ti and 5080, are missing from it: nobody has published a credible hashcat -b run for them yet, and we will add real figures when they exist rather than estimate. By core count they slot between the 5060 Ti and the 5090, but for cracking specifically a used 3090 or 4090 usually gives you more guesses per dollar than a new mid-range card at shortage prices.
One more practical point for multi-card rigs. Hashcat scales almost linearly across identical GPUs, so two 3090s roughly double your rate, which is often cheaper than one card a tier up. If you go that route, size the power and airflow for the full stack from the start, and lab it on a platform you control. A Proxmox host with GPU passthrough or a dedicated Kali Linux install both make clean, repeatable cracking boxes.
Match the card to the hash
There is no single best GPU for hashcat, only the best card for your budget and the hashes you face. Run this short checklist before you buy, and let the published figures, not the spec sheet, settle it.
- You crack fast hashes on a deadline and budget is open: the RTX 5090 tops every fast mode at about 324 GH/s NTLM.
- You want the most throughput per dollar: a used RTX 3090 gives roughly 126 GH/s NTLM for a fraction of a 5090.
- You crack mostly bcrypt or other slow hashes on a one-off job: rent an H100, which nearly matches a 5090 there without the five-figure outlay.
- You are learning or running small jobs on low power: the RTX 5060 Ti 16GB is the current-gen card that’s actually in stock.
- You found a genuine, warrantied RTX 4090 near used-3090 money: it’s the best all-rounder of the consumer cards.
Whatever you pick, confirm it on your own hardware with hashcat -b once it arrives, because your driver, cooling and power limit shift the result by more than the gap between two neighbouring cards. The benchmark is free and it is the only number that describes your box.
