How Long Would It Take to Crack Your Password?

Published June 7, 2026

Short answer: it depends almost entirely on two things — how long your password is and how many character types it uses. A truly random 8-character password can fall in about two hours. Add four characters and it jumps to thousands of years. Add four more and no computer on Earth will crack it before the sun burns out. The catch: this only holds for random passwords. Anything based on a word, name, or pattern is cracked almost instantly, no matter how long.

Password crack time by length (2026)

The table below estimates the time to brute-force a fully random password — the kind our password generator produces — assuming roughly 100 billion guesses per second, a realistic rate for a determined attacker with high-end hardware running an offline attack against a stolen, fast-hashed database.

"All character types" means uppercase, lowercase, numbers, and symbols (about 94 possibilities per position). Figures are rounded order-of-magnitude estimates for fully random passwords.

How password cracking actually works

Passwords are rarely "guessed" one at a time by a person at a login screen. Real attacks fall into two categories, and the difference matters enormously:

• Online attacks — the attacker submits guesses to a live login form. These are slow: rate limits, lockouts, and CAPTCHAs cap them at a handful of attempts per second. Even a weak 8-character password can survive an online attack for a long time.
• Offline attacks — the attacker has stolen a database of hashed passwords (from a breach) and cracks them on their own hardware, with no rate limit. This is where the billions-per-second figures come from, and it's the scenario the table above models.

Within an offline attack, attackers don't start with brute force. They start smart, in this order:

1. Dictionary & breach lists — every word in the dictionary plus billions of passwords leaked in past breaches.
2. Rules & mutations — capitalizing the first letter, adding "1!" at the end, swapping "a" for "@". Attackers automated these tricks years ago.
3. Masks & patterns — common structures like Word + 4 digits, or a name + birth year.
4. Pure brute force — trying every possible combination, character by character. Only used as a last resort, and only feasible against short passwords.

This is why Summer2026! is cracked in milliseconds despite being 11 characters: it matches a predictable pattern attackers try first. A random 11-character string would last months.

Why length beats complexity

People assume swapping "a" for "@" makes a password strong. It barely helps. Each extra character multiplies the number of possible combinations, while a single substitution adds almost nothing. As the table shows, a random 16-character lowercase password (~14,000 years) is dramatically harder to crack than an 8-character password using every symbol on the keyboard (~2 hours). The rule worth remembering: add length first, complexity second.

What "entropy" means

Security researchers measure password strength in bits of entropy — roughly, the number of yes/no questions an attacker must answer to find your password. Each bit doubles the work. Under 50 bits is weak; 60–75 bits is solid for everyday accounts; 80+ bits will outlast any foreseeable hardware. A random 12-character all-types password sits around 78 bits; a 16-character one around 105 bits.

How long should your password be?

• Throwaway accounts (forums, newsletters): 12 random characters is plenty.
• Everyday accounts (shopping, streaming, social): 16 characters with mixed types.
• High-value accounts (primary email, banking, password-manager master password): 20+ characters, or a long passphrase you can actually remember.

For the strongest everyday option, generate a 20-character password — it falls into the "practically forever" column and there is no realistic attack against it.

The bottom line

A password's crack time is meaningless if the password isn't random. The safest move is to let a generator do it: our free password generator uses your browser's cryptographically secure random number generator, so the result has no human pattern for an attacker to exploit — and nothing is ever sent to a server. Then store each one in a password manager so length stops being a memory problem.

Ready to make yours uncrackable? Use the password generator, the 20-character generator for high-value accounts, or a memorable passphrase.

← Back to Blog