How Fast Could Someone Guess Your VPN Password?

Latency answers a question nobody asked. Three conditions decide what a guessing estimate actually means: whether the guess is checked by a live service or against captured material, which authentication method produced that material, and what controls the service enforces. A ping measures one round trip on one path and answers none of them. Dividing a second by that number produces a figure that is precise, unrelated and often repeated as if it were a security property.

Latency belongs to connectivity work. Authentication strength is a property of the verifier and the protocol.

One Round Trip Is Not a Rate Limit

A round-trip time describes how long one request and its response take on a particular path. Even for online attempts, throughput depends on how many requests a client keeps outstanding, how long the server spends per attempt, and what rate limits are enforced. Those are independent of the ping. An Ethernet link does not impose a rule that only one attempt can exist per round trip, and a fast ping does not prove a verifier will accept guesses at that rate.

If the service locks an account after five failures, the practical rate is five attempts per lockout window regardless of the network. That is a control, and it is the number worth citing.

Where the Guess Is Actually Checked

Online, the claimant submits each candidate to the real service, which can observe, delay, lock and alert. Offline, an attacker holding suitable verification material checks candidates locally with no service involvement. That distinction decides almost everything about the arithmetic. NIST's password guidance treats these threats separately, calling for rate limiting of failed online attempts and for storage that resists offline attack through salted hashing with a cost factor. Both are properties of the verifier and the storage layer, with no dependence on how fast the user's link answers.

Whether a packet capture yields useful material depends on the protocol and the authentication method. Owning a capture, a certificate or an encrypted tunnel answers nothing by itself, and neither does the age of the client build.

Why Crack-Time Arithmetic Misleads

A count of possible strings is only as good as its assumptions. Human-chosen passwords are not uniformly distributed over the space a formula describes, and reused credentials may already be in a list. The checking cost matters too: an online service with enforced controls differs completely from a stolen verifier tested locally. A calculation that quietly moves between those cases cannot support a years-to-crack claim.

Keep protocol defects in their own column as well. A longer password does not repair a weak authentication construction, and one obsolete method does not prove that every password-based design shares its weaknesses. Those are separate findings with separate fixes.

Ask for Verifier Evidence, Not Latency

For a gateway assessment, identify the authentication method, who holds the verifier, what attempt controls exist and whether a second factor is genuinely independent. A dialog with two password boxes does not establish two factors. For stored credentials, establish what material exists, who can read it and what protection the implementation actually applies. A hypothetical hash-rate figure is not evidence about an unidentified storage system.

Consider exposure outside guessing as well. A stolen profile, a compromised endpoint or a phishing flow presents a different problem from an attacker enumerating passwords, and password length does nothing about authority already granted to an active session.

Record the method, the control and the storage protection. Those three answer the question the ping was never measuring.