How Long Does It Take to Crack a Password? A Length Chart

How long a password lasts against a brute-force attack depends on two numbers: how many characters it has, and how fast the attacker can guess. Length matters most, because each extra character multiplies the number of possibilities. The table below gives average times for passwords of different lengths. They are illustrations of the maths, not promises, and the assumptions behind them matter, so they are explained below.

The maths

If a password is chosen at random from an alphabet of c characters and has L characters, there are c^L possible passwords. On average an attacker finds the right one after trying half of them:

Average time = c^L ÷ 2 ÷ guesses per second

• Lowercase letters only: c = 26
• Letters of both cases: c = 52
• Letters and digits: c = 62
• All printable ASCII (letters, digits, symbols): c = 94

The table uses a rate of 10 billion guesses per second. That is a realistic order of magnitude for an offline attack on a stolen database that stored passwords with a fast, unsalted hash such as MD5 or SHA-1, using several modern graphics cards.

Why the rate changes everything

The guess rate depends on how the site stored your password, and this swings the times by a factor of millions.

• Fast hashes (MD5, SHA-1, unsalted SHA-256): billions of guesses per second. These are the cases in the table.
• Slow, purpose-built hashes (bcrypt, scrypt, Argon2, PBKDF2 with a high count): designed to cost time and memory per guess, bringing rates down to thousands or fewer per second per device. The same 8-character password that falls in days against MD5 can last many years.
• Online attacks against a login page: limited by rate limiting, lockouts and CAPTCHAs to a handful of guesses per second at most. Brute force is rarely the way in.

You cannot see how a site stores passwords, so the safe approach is to assume the worst case and choose a long password. That also covers a service that gets breached, which is the case where offline cracking actually occurs.

What the table shows

• 8 characters is weak even with symbols. 3.5 days against a fast hash is not safe for anything that matters.
• Length beats complexity. 12 lowercase letters (55 days) are far tougher than 8 characters of every type (3.5 days). Adding four characters multiplies the work by 26⁴, about 457,000, while enlarging the alphabet from 26 to 94 multiplies it by only a factor of about 3.6 per position.
• 12 mixed characters is strong, 16 is overkill for brute force. Beyond about 12 random characters, guessing is not how accounts get compromised.

Random passphrases

A passphrase made of random words is easy to remember and has substantial strength. Using a list of 7,776 words (as in the Diceware method), each word adds about 12.9 bits.

• 4 random words: 7,776⁴ ≈ 3.7 × 10¹⁵, about 52 bits. Average time at 10 billion guesses a second: roughly 2 days.
• 5 random words: about 65 bits, roughly 45 years.
• 6 random words: about 78 bits, roughly 350,000 years.

For an important account, use at least five or six words, and let a tool pick them. The password generator creates random passwords, and a password manager stores them so you only memorise one.

The caveat: humans are not random

All of the times above assume the password was chosen at random. Real attackers do not try every combination in order. They try common passwords, leaked passwords, dictionary words, names, dates, keyboard patterns and predictable substitutions like "P@ssw0rd1!" first. A password that looks complex but follows a pattern can fall in seconds. This is why "Summer2026!" is poor despite having four character types, and why the password strength checker looks for patterns and not just length. Nothing you type there leaves your browser.

What to do

1. Use a password manager and let it generate a unique random password of 16 or more characters for every account.
2. For the few passwords you must remember, use a random passphrase of five or six words.
3. Turn on two-factor authentication for email, banking and anything that can reset other accounts. A stolen password is then not enough.
4. Never reuse a password. Reuse turns one breach into many.

Frequently asked questions

Is a 12-character password enough?

If it is random and unique, yes for almost everything. If it is a predictable phrase or reused, no. Randomness and uniqueness matter more than the exact length.

Do symbols make a password much stronger?

Only a little. A symbol enlarges the alphabet, but a few extra characters of length add much more. Symbols in predictable places (a "!" at the end) add almost nothing.

Are the times in the table accurate?

They are accurate maths for the stated assumptions, and attackers' hardware keeps improving, so treat them as orders of magnitude. The conclusion, that length dominates, does not change.

How does a site store my password safely?

It should store only a salted hash made with a slow algorithm such as Argon2 or bcrypt, never the password itself.