- Crack-time table
- Three attack scenarios
- How it is calculated
- Length vs complexity
- Where estimates break down
- What to do
- FAQ
Password Crack-Time Table
The table shows the average time to crack a truly random password in an offline attack against a fast, unsalted hash, assuming 150 billion guesses per second. Read across to see the effect of the character set, and down to see the effect of length.
| Length | Digits only | Lowercase | Upper + lower | Letters + digits | All printable (94) |
|---|---|---|---|---|---|
| 6 characters | Instantly | Instantly | Instantly | Instantly | 2 seconds |
| 8 characters | Instantly | Instantly | 3 minutes | 12 minutes | 6 hours |
| 10 characters | Instantly | 8 minutes | 6 days | 32 days | 6 years |
| 12 characters | 3 seconds | 4 days | 41 years | 341 years | 50 thousand years |
| 14 characters | 6 minutes | 7 years | 112 thousand years | 1 million years | 444 million years |
| 16 characters | 9 hours | 5 thousand years | 302 million years | 5 billion years | 4 trillion years |
| 20 characters | 11 years | 2 billion years | 2.2 × 1015 years | 7.4 × 1016 years | 3.1 × 1020 years |
For scale, the universe is about 13.8 billion years old. Values far beyond that are shown only to make the exponential growth visible.
Three Attack Scenarios Compared
How fast an attacker can guess depends on how the password is stored and where it is being guessed. The same password can fall in seconds in one scenario and last millennia in another.
- Online attack (100 guesses per second): guessing through a login form that rate-limits or locks accounts.
- Offline, slow hash (2,000 guesses per second): an attacker holding stolen hashes protected by a deliberately slow algorithm such as bcrypt (cost 12) or Argon2.
- Offline, fast hash (150 billion guesses per second): stolen hashes made with a fast algorithm such as MD5 or NTLM.
| Password type | Entropy | Online | Offline, slow hash | Offline, fast hash |
|---|---|---|---|---|
| 8 characters, lowercase only | 38 bits | 33 years | 1 year | Instantly |
| 8 characters, all types | 52 bits | 966 thousand years | 48 thousand years | 6 hours |
| 12 characters, lowercase only | 56 bits | 15 million years | 756 thousand years | 4 days |
| 12 characters, all types | 79 bits | 75 trillion years | 4 trillion years | 50 thousand years |
| 16 characters, all types | 105 bits | 5.9 × 1021 years | 2.9 × 1020 years | 4 trillion years |
| 4-word passphrase | 52 bits | 579 thousand years | 29 thousand years | 3 hours |
| 6-word passphrase | 78 bits | 35 trillion years | 2 trillion years | 23 thousand years |
Passphrases assume words chosen at random from a 7,776-word list (Diceware style). Chosen by a person instead of by a random generator, they are much weaker.
How the Numbers Are Calculated
The number of possible passwords is the size of the character pool raised to the power of the length. A random password of 12 characters drawn from 94 printable ASCII characters has 9412 possibilities. An attacker finds the password on average after trying half of them, so:
average time = (poollength ÷ 2) ÷ guesses per second
The same space expressed in bits is the password's entropy: length × log2(pool size). You can check any pattern with our Password Entropy Calculator.
Where the guess rates come from
The fast-hash figure is the order of magnitude published in public Hashcat benchmarks for a single NVIDIA RTX 4090: about 156 billion MD5 guesses per second and about 286 billion NTLM guesses per second. The same benchmark reports about 240,000 bcrypt guesses per second at the low default cost factor. Real systems use a much higher cost: each step up doubles the work, so cost 12 is 128 times slower, roughly 1,900 guesses per second, which we round to 2,000. The online rate of 100 per second is an illustrative assumption for a login form with no strict lockout. See the published benchmark. An attacker with several GPUs is proportionally faster, and hardware improves over time.
Why Length Beats Complexity
Adding one more character multiplies the number of possibilities by the full pool size, while adding a new character type only enlarges the pool once. For example, a random 12-character password using letters and digits (62 characters) takes about 341 years, but simply making it 13 characters raises that to about 21 thousand years. Between 10 and 16 characters of full-set randomness, the estimate climbs from about 6 years to about 4 trillion years.
That is why we recommend choosing length first. Our 12-character and 16-character generators both build a random password in your browser, and nothing is sent to a server.
Where These Estimates Break Down
- Predictable passwords. The table applies only to random passwords. Attackers try breach lists, dictionary words and common substitutions first, so a password like a word plus digits can fall in seconds regardless of length.
- Reuse. A strong password reused on several sites is only as safe as the weakest site that stores it. Stolen credentials are tried against other services automatically.
- Hash choice. You cannot see how a website stores your password. Choosing a long random password protects you whether it uses a fast or a slow hash.
- Hardware growth. Guessing speeds rise over time, which is why the table's "adequate" band deserves a safety margin.
- Phishing and malware. No crack-time figure helps if the password is typed into a fake page or captured by malware. Two-factor authentication covers that gap.
You can see how common patterns are judged with our Password Strength Checker.
What to Do With This Information
- Use at least 12 random characters for ordinary accounts and 16 or more for email, banking and your password manager. Generate them with the Strong Password Generator instead of inventing them.
- If you must memorise a password, use a random passphrase rather than a clever phrase. How many words you need depends on the size of the word list, as explained in passphrase vs password.
- Use a different password for every account, and store them in a password manager.
- Turn on two-factor authentication wherever it is offered, particularly for email.
- For sites that insist on symbols, use the Password Generator with Symbols or the Secure Password Generator.