Someone turned a Game Boy Advance into a password cracker

A Game Boy Advance has been turned into a working SHA-256 password cracker. Yes, the handheld Nintendo console from 2001. It runs at just 16.78 MHz, has no modern graphics processor and was built to play games such as Advance Wars and Metroid Fusion. Yet with the right software, it can load possible passwords, calculate their hashes and check them against a target. It works. That’s the surprising part. Speed is another matter. The handheld manages around 727 SHA-256 hashes per second. A modern password-cracking system with powerful graphics hardware can process the same kind of workload millions of times faster. What takes a current GPU setup about one second could keep the Game Boy Advance busy for roughly 350 days. That gap tells us far more than the raw number alone.

Hashcat, but stripped down for a handheld

The project takes inspiration from Hashcat, the password-recovery tool used by security researchers, system administrators and penetration testers. It isn’t a complete port, though. Full Hashcat supports a huge range of hash formats, attack methods, custom rules and hardware acceleration. None of that would fit comfortably on a Game Boy Advance. The handheld version sticks to a much simpler task.

It reads passwords from a built-in wordlist, calculates the SHA-256 hash for each one and compares the result with a target hash. When the two values match, it has found the password. Simple idea. Heavy workload.

The wordlist contains about one million entries and takes up roughly 8 MB of storage. That’s a substantial amount of data for a console from the early 2000s, especially when the entire application has to live inside a GBA cartridge image.

There’s no operating system managing the work in the background. There’s no GPU stepping in to accelerate the calculations. The console’s ARM7TDMI processor does everything itself, one candidate after another.

The numbers get ridiculous very quickly

At 727 hashes per second, the Game Boy Advance can check more than 62 million password candidates in a day. That sounds impressive until you compare it with current hardware. Over 350 days, it could test around 22 billion candidates. A capable modern cracking rig may finish that same job in about a second.

That’s roughly a 30-million-fold performance difference. Modern graphics processors handle this work well because they contain thousands of small processing units that can run similar calculations at the same time. Password cracking benefits from that design. Each guess can be processed independently, so the GPU simply throws vast amounts of parallel computing power at the problem.

The Game Boy Advance can’t do that. Its processor was designed for game logic, sprite movement, sound and basic graphics. It handles one main stream of instructions and operates within tight limits on memory, power and storage. SHA-256 puts those limits on display immediately.

It also shows why password storage matters

The experiment offers a useful reminder about how websites and applications protect passwords. SHA-256 is a fast cryptographic hash function. That speed is helpful when checking files, verifying data or handling digital signatures. It’s less helpful when storing passwords. Attackers want fast hashes. Faster calculations mean more guesses every second.

That’s why responsible systems don’t usually store passwords with plain SHA-256. They use password-specific functions such as Argon2, bcrypt or scrypt. These algorithms deliberately require more processing time, memory or both. That makes every password guess more expensive. A unique salt also stops attackers from reusing precomputed hash lists across multiple accounts.

The Game Boy Advance project doesn’t expose a new security weakness. It demonstrates an existing one in a form that’s easy to understand. If even a small handheld can perform the basic cracking process, modern hardware can do it on an entirely different scale.

Clever engineering inside tight limits

The application was built with Butano, a C++ development engine for Game Boy Advance homebrew software. Butano handles much of the console-specific work, including graphics, controls and resource management. That leaves the programme free to focus on the hashing process.

The final cartridge image is about 8.5 MB, with the password list taking up most of the space. It can run in an emulator or on original hardware with a compatible flash cartridge. The interface shows the current progress on the GBA screen. Behind that display, the system repeats the same loop: load a password, calculate its SHA-256 hash, compare it with the target and move to the next entry.

There’s nothing fake about the process. It’s a real password cracker running on real Nintendo hardware. It’s simply very, very slow.

A benchmark people can instantly understand

This project won’t replace professional security tools, and nobody expects it to. Its value comes from the comparison. Performance figures such as hashes per second can feel abstract. Watching a Game Boy Advance attempt the same task as a modern GPU makes the difference much easier to grasp.

Both machines perform the same mathematical operation. Both produce the correct result. One could finish before you lift your coffee cup. The other might still be working when the same date appears on next year’s calendar. That’s what makes the experiment so effective. It turns decades of computing progress into something you can see on a 2.9-inch screen.

Spread the love