Fields with a short limit
Some older systems cap passwords at 12 characters or quietly cut longer ones. A random 12 with all four character types is the strongest password those fields accept.
12-character password generator
Twelve characters. Truly random.
Many sites and policies ask for at least 12 characters. Twelve random characters with all four types hold for thousands of years against a GPU cluster; twelve characters you make up do not. This one is drawn by the Web Crypto API, on your device.
Calculating…
PINs are only safe where attempts are limited, like a phone or a bank card. Obvious ones (1234, 0000, 1212) are skipped.
10 fresh passwords
Time to crack your 12-character password
Measuring…
Worst case: an offline attack on a fast hash by a GPU cluster testing one trillion guesses per second.
You are here
- 1 second
- 1 hour
- 1 year
- A lifetime
- The pyramids
- Since the dinosaurs
- Age of the universe
The numbers
Is a 12-character password strong enough?
At 12 characters, everything depends on the mix. Here is how long 12 random characters last offline against a GPU cluster on a fast hash (1 trillion guesses per second) and a GPU rig on bcrypt (100,000 guesses per second).
| 12 random characters | Entropy | GPU cluster, fast hash | GPU rig, bcrypt |
|---|---|---|---|
| Numbers only 0-9 | 40 bits | instantly | 2 months |
| Lowercase a-z | 56 bits | 13 hours | 15 thousand years |
| Upper and lower a-z A-Z | 68 bits | 6 years | 62 million years |
| Letters and numbers a-z A-Z 0-9 | 71 bits | 51 years | 511 million years |
| Letters, numbers and symbols + !@#$% | 77 bits | 3 thousand years | 30 billion years |
At this length, symbols matter: they turn about 51 years into about 3,000 years against the fastest attack. If a site refuses symbols, choose 16 characters instead.
When to use it
Where 12 characters make sense.
Policies that ask for 12
PCI DSS 4.0 requires at least 12 characters for accounts that can reach card data, and France's CNIL recommends 12 characters mixing all four types when a password is the only protection.
Accounts with two-factor authentication
NIST accepts 8 characters when the password is one of two factors and asks for 15 when it stands alone. Twelve random characters plus an authenticator app is a comfortable setup.
When to go longer
Your email, your bank and your password manager deserve more. Use 16 characters or more, or a passphrase for the passwords you type yourself.
Questions
12-character password FAQ
Is a 12-character password secure?
Yes, if it is random and mixes all four character types: about 77 bits of entropy, or roughly 3,000 years for a GPU cluster attacking a fast hash. A 12-character password you invent, like Summer2026!!, follows a pattern and falls in minutes.
How long does it take to crack a 12-character password?
From instantly to thousands of years, depending on the characters. On a fast hash, 12 random digits fall at once, 12 random lowercase letters in about 13 hours, letters and numbers in about 51 years, and letters, numbers and symbols in about 3,000 years. Sites that store passwords with bcrypt or Argon2 multiply those times by about ten million.
Does a 12-character password need symbols?
At this length, yes, whenever the site allows them. Symbols make a 12-character password about 60 times harder to crack than letters and numbers alone. If a site rejects symbols, use 16 characters instead.
Is 12 characters enough for NIST?
NIST SP 800-63B asks for at least 15 characters when a password is the only factor, and 8 when it is combined with another factor such as an authenticator app. So 12 characters meets NIST when two-factor authentication is on.
Can I remember a 12-character random password?
Most people cannot, and they do not need to: store it in a password manager. For a password you type every day, a passphrase of 5 or 6 random words is easier to remember and comparably strong.
More free tools
Passphrase generator
Random words you can actually remember, with the entropy of a 16-character password.
Open toolWi-Fi password + QR code
A strong WPA2/WPA3 key and a QR code your guests scan to join, with a card to print.
Open toolStrength test
See your password the way an attacker does: patterns, entropy and four crack-time scenarios.
Open toolBreach checker
Find out if a password already leaked, without ever revealing it (k-anonymity).
Open toolPassword policy builder
NIST, PCI DSS and CIS presets with ready-to-run Windows, Active Directory and Linux scripts.
Open toolCrack-time table
How long every length and character mix survives a modern GPU cracking rig.
Open tool