It assumes randomness
The table is for passwords picked by a machine. Summer2026! has 11 characters but falls like a 5-character one, because cracking tools try words and years first.
Crack-time table, 2026 edition
How long does it take to crack a password?
Every length from 4 to 24 characters, every character mix, against four real attack speeds. Pick an attacker and watch the colors change.
| Length | Numbers only0-9 | Lowercasea-z | Upper and lowera-z A-Z | Letters and numbersa-z A-Z 0-9 | All printable+ !@#$% |
|---|---|---|---|---|---|
| 4 | Instant | Instant | Instant | Instant | Instant |
| 5 | Instant | Instant | Instant | Instant | Instant |
| 6 | Instant | Instant | Instant | Instant | Instant |
| 7 | Instant | Instant | Instant | 2 sec | 32 sec |
| 8 | Instant | Instant | 27 sec | 2 min | 51 min |
| 9 | Instant | 3 sec | 23 min | 2 hours | 3 days |
| 10 | Instant | 1 min | 20 hours | 5 days | 312 days |
| 11 | Instant | 31 min | 44 days | 301 days | 80 years |
| 12 | Instant | 13 hours | 6 years | 51 years | 7.5k yrs |
| 13 | 5 sec | 14 days | 322 years | 3.2k yrs | 709k yrs |
| 14 | 50 sec | 1 year | 17k yrs | 196k yrs | 67M yrs |
| 15 | 8 min | 27 years | 871k yrs | 12M yrs | 6.3B yrs |
| 16 | 1 hour | 691 years | 45M yrs | 755M yrs | 589B yrs |
| 17 | 14 hours | 18k yrs | 2.4B yrs | 47B yrs | 55T yrs |
| 18 | 6 days | 467k yrs | 122B yrs | 2.9T yrs | 1015 yrs |
| 19 | 58 days | 12M yrs | 6.4T yrs | 180T yrs | 1017 yrs |
| 20 | 2 years | 316M yrs | 331T yrs | 1016 yrs | 1019 yrs |
| 21 | 16 years | 8.2B yrs | 1016 yrs | 1017 yrs | 1021 yrs |
| 22 | 158 years | 213B yrs | 1017 yrs | 1019 yrs | 1023 yrs |
| 23 | 1.6k yrs | 5.5T yrs | 1019 yrs | 1021 yrs | 1025 yrs |
| 24 | 16k yrs | 144T yrs | 1021 yrs | 1023 yrs | 1027 yrs |
- Instant
- Under a day
- Under 100 years
- Under the age of the universe
- Longer than the universe has existed
How to read it
Three things the colors will not tell you.
Reuse beats any row
If a password leaked once, its crack time is zero: attackers simply try the known list. Uniqueness matters as much as length. Check yours.
Hardware only gets faster
A trillion guesses per second is a cluster of modern GPUs today. Add a few characters of margin: each one multiplies the work by up to 94.
Methodology
Each cell is the average time to find a random password: half of all possible combinations (character set size raised to the length), divided by the attack speed. We use four speeds:
- Offline, fast hash: 1012 guesses per second. A cluster of high-end GPUs attacking unsalted MD5 or NTLM hashes. A single current gaming GPU manages on the order of a hundred billion MD5 guesses per second.
- Offline, slow hash: 105 guesses per second. A GPU rig against bcrypt or Argon2 with sensible settings.
- Online, no rate limit: 10 guesses per second. A bot hammering a login form that never blocks it.
- Online, rate-limited: 100 guesses per hour. A site with lockouts and bot protection.
The "all printable" column uses the 94 printable ASCII characters. Results are rounded. The table is generated live in your browser from the same engine as our password strength test.
Use this table on your site
Free to cite in articles, slides and training, with a link back to this page.
Questions
Crack-time FAQ
How long does it take to crack an 8-character password?
Against a GPU cluster attacking a fast hash such as MD5 or NTLM, a random 8-character password using all 94 printable characters falls in under an hour on average. Lowercase only, it takes well under a second. Human-chosen 8-character passwords are usually much faster to crack than the table shows.
How long should a password be to be safe from cracking?
With a mix of letters, numbers and symbols, 12 characters already takes thousands of years in the worst case, and 16 characters takes longer than the age of the universe. We recommend 16 or more for important accounts, or a passphrase of 6 or 7 random words.
Why are the times different from other crack-time tables?
Every table assumes a different attacker. We show four, from a rate-limited login form to a GPU cluster on a leaked fast hash, and we report the average time (half the possible passwords). Pick the scenario that matches your threat.
Does the table apply to my password?
Only if it was generated randomly. People rarely pick random characters, and cracking tools try dictionary words, names, dates and common substitutions first. Test a real-world style password with the strength test to see the difference.
What changes if the site uses bcrypt or Argon2?
Slow hashes are designed to be expensive to compute, which cuts attack speed from about a trillion guesses per second to around a hundred thousand. Switch the table to the slow-hash scenario: most rows turn green.
Make your row turn blue
Password generator
Random passwords, passphrases or PINs, created by the Web Crypto API on your device.
Open toolPassphrase generator
Random words you can actually remember, with the entropy of a 16-character password.
Open toolStrength test
See your password the way an attacker does: patterns, entropy and four crack-time scenarios.
Open toolBreach checker
Find out if a password already leaked, without ever revealing it (k-anonymity).
Open toolPassword policy builder
NIST, PCI DSS and CIS presets with ready-to-run Windows, Active Directory and Linux scripts.
Open tool