How Long Does It Take to Crack a Password?
The Short Answer
It depends on three things: the length of the password, the character set used, and the speed of the attacker's hardware. An 8-character lowercase password can be cracked in under a second. A 20-character password with mixed character types would take longer than the age of the universe.
The difference between these two outcomes is not magic -- it is math. Understanding that math helps you make informed decisions about password strength.
How Brute Force Attacks Work
A brute force attack tries every possible combination until it finds the right one. The total number of combinations is:
Combinations = (Character Set Size) ^ (Password Length)
For a lowercase-only alphabet (26 characters), an 8-character password has:
26^8 = 208,827,064,576 combinations (about 209 billion)
That sounds like a lot. It is not. A modern GPU can compute billions of password hashes per second. At 10 billion guesses per second, 209 billion combinations takes about 21 seconds.
Expanding the character set changes the math dramatically:
- Lowercase only (26): 26^8 = 209 billion
- Mixed case (52): 52^8 = 53.5 trillion
- Mixed case + digits (62): 62^8 = 218 trillion
- Full ASCII including symbols (95): 95^8 = 6.6 quadrillion
Same length, but increasing the character set from 26 to 95 multiplies the search space by 31,000x.
Password Crack Time Table
The following table assumes an attacker using a high-end GPU cluster capable of 10 billion guesses per second against a fast hash (like MD5 or NTLM). Real-world crack times depend heavily on the hashing algorithm used by the service.
| Length | Lowercase Only (26) | Mixed Case + Digits (62) | Full ASCII (95) |
|---|---|---|---|
| 6 | Instant | Instant | Instant |
| 8 | 21 seconds | 6 hours | 7.6 days |
| 10 | 4 hours | 2.5 years | 1,899 years |
| 12 | 127 days | 9,646 years | 17.1 million years |
| 14 | 234 years | 37 million years | 15.4 billion years |
| 16 | 159,000 years | 143 billion years | 14.7 quadrillion years |
| 20 | 71 billion years | 5.4 x 10^21 years | 1.3 x 10^29 years |
The age of the universe is about 13.8 billion years. A 16-character password with full ASCII is effectively uncrackable by brute force.
What Attackers Actually Use
Pure brute force is the slowest method. Real attackers are more efficient.
Dictionary Attacks
Instead of trying every combination, attackers try words and common passwords first. Lists of billions of previously breached passwords are freely available. If your password is "sunshine," "password123," or "qwerty2026," it will be found in seconds regardless of length.
Rule-Based Attacks
Attackers apply transformation rules to dictionary words: capitalize the first letter, add a number at the end, replace "a" with "@", append "!" -- these patterns are extremely common and well-known. "P@ssw0rd!" looks complex to a human but falls instantly to a rule-based attack.
Rainbow Tables
A rainbow table is a precomputed lookup of hash values. Instead of hashing every guess in real time, the attacker looks up your password's hash in the table. Rainbow tables can crack unsalted hashes almost instantly.
Defense: Modern services use salted hashes, which make rainbow tables ineffective. Each password gets a unique random salt before hashing, meaning an attacker would need a separate rainbow table for every single salt -- computationally impractical.
Credential Stuffing
This is not cracking at all. Attackers take username/password pairs from one breach and try them on other services. If you reused your password, they are in. No computation needed.
GPU and Hardware Speeds
The "10 billion guesses per second" figure used above is conservative for weak hash algorithms. Here are realistic speeds for different hashing algorithms on a modern GPU cluster (8x RTX 4090):
| Algorithm | Guesses Per Second |
|---|---|
| MD5 | ~300 billion |
| NTLM | ~280 billion |
| SHA-1 | ~50 billion |
| SHA-256 | ~20 billion |
| bcrypt (cost 10) | ~500,000 |
| Argon2 (default) | ~10,000 |
The difference is staggering. Against bcrypt, that 8-character lowercase password that fell in under a second against MD5 would take about 4.8 days. Against Argon2, it would take over 240 days.
This is why the hash algorithm matters as much as the password itself. Unfortunately, you have no control over which algorithm a service uses. Your only defense is making your password strong enough that even fast algorithms do not help the attacker.
Real-World Examples
These high-profile cases illustrate why password strength matters:
LinkedIn (2012): 6.5 million passwords leaked, hashed with unsalted SHA-1. Researchers cracked 90% of them within hours. Most were short, common, or dictionary-based.
RockYou (2009): 32 million passwords stored in plain text. The most common was "123456" (used by 290,000 accounts). Analysis showed that 40% of users chose passwords from a relatively tiny set of common strings.
Collection #1-5 (2019): 2.2 billion unique email/password pairs aggregated from multiple breaches. This dataset powers credential stuffing attacks to this day.
LastPass (2022): Encrypted password vaults were stolen. Users with weak master passwords (short, dictionary-based) were vulnerable to offline brute force. Users with strong, random master passwords were protected even though the vaults were taken.
The lesson across all of these: length and randomness determine whether your password survives a breach.
How to Make Your Password Uncrackable
Based on the math above, the formula is straightforward:
- Use at least 16 characters. This puts you beyond brute-force range against even the fastest algorithms.
- Use the full character set. Lowercase, uppercase, digits, and symbols maximize entropy per character.
- Generate it randomly. Any human-chosen pattern reduces effective entropy by orders of magnitude. Use a password generator that uses cryptographic randomness.
- Never reuse passwords. A strong password is worthless if it was exposed in another service's breach.
- Enable 2FA. Even an uncrackable password cannot protect against phishing. A second factor can.
Conclusion
The time to crack a password follows an exponential curve. Each additional character multiplies the difficulty. Each expansion of the character set multiplies it further. A randomly generated 16+ character password with full ASCII characters is beyond the reach of any current or foreseeable attack. Generate one with our free password generator and remove any doubt about whether your credentials can withstand an attack.
Need a strong password?
Generate One Free