| password | Password or secret to evaluate. Use a GitHub secret for real values. Either `password` or `guesses` must be provided. | no | — |
| guesses | External guess count (e.g. zxcvbn's `guesses` field). When set, brtc's built-in entropy estimator is skipped and the password argument becomes optional. | no | — |
| algorithm | Hash algorithm — md5, sha256, bcrypt, argon2id. | no | bcrypt |
| cost | Work factor (bcrypt) or time iterations (argon2id). | no | 10 |
| memory | Argon2id memory parameter (e.g. 64m, 128m, 1g). Ignored by other algorithms. | no | — |
| hardware | Attacker hardware profile — rtx-4090, rtx-3060, gtx-1080ti, mac-m3, mac-m3-max, cpu-standard, aws-p5.48xlarge, raspberry-pi-4. | no | rtx-4090 |
| all-hw | Set to `true` to compare the input across every hardware profile instead of a single one. Not combinable with `fail-under-time`, `budget`, or `output: sarif` (those are ignored or rejected). | no | false |
| fail-under-time | Fail the job if the estimated crack time is shorter than this duration (e.g. 1y, 30d, 12h, 5m). Leave empty to never fail on time. | no | — |
| budget | Attacker budget in USD (e.g. 1000usd) for the "max safe characters" output. | no | — |
| output | brtc output format. Defaults to `json` so the parsed action outputs (`cost-usd`, etc.) are populated. Set to `sarif` to produce a SARIF report (path exposed via the `sarif-file` output) for Code Scanning. | no | json |
| brtc-version | brtc release tag to install (e.g. v1.2.0, latest, main). Pinned to a released tag by default for reproducibility; `latest`/`main` are not reproducible. | no | v1.2.0 |
| go-version | Go toolchain version used to install brtc. | no | 1.25 |