How Long Does It Take to Crack a Password? (2026 Tables)
“How long would it take to crack my password?” has no single answer, because it depends far more on how the password is attacked than on the password itself. The same 8-character password survives thousands of years against one attack and falls in an afternoon against another. This guide gives you the tables, explains the assumptions behind every number, and ends with a length you can actually use.
The short answer
- 8 random characters (letters, digits, symbols): about 5 hours on one GPU if the site stored it with MD5, about 17,000 years with bcrypt.
- 12 random characters: about 47,000 years on one GPU even against MD5, and still decades with 1,000 GPUs.
- 16 random characters: beyond the reach of any computer, now or foreseeable.
- Any password you invented (a word, a name, a year, a symbol): often minutes, whatever its length, because it is guessed from patterns rather than brute force.
What the time depends on
Three things determine the cracking time of a randomly generated password:
- The number of possible passwords, NL for length L drawn from N characters. Each extra character multiplies it by N; this is why length dominates. See password entropy explained.
- The guess rate, set by where the attack happens and how the password was stored. This varies by a factor of more than a trillion between scenarios.
- The attacker’s budget: one GPU, a rented cluster of hundreds, or more. Time divides linearly by the number of GPUs.
On average the password is found after half of the possibilities have been tried, so all figures below are NL ÷ 2 ÷ guesses per second.
Online attacks: the login form
If attackers must go through a website’s login page, the site decides the rate. A service that locks or slows an account after a few failures, as most banks and large providers do, keeps them to roughly 100 guesses per hour. At that speed a random 8-character lowercase password would take over 100,000 years. Online guessing only succeeds against the most common passwords, which is why sites should block those outright.
Offline attacks: a stolen database
The dangerous case is a breach. Once attackers have a copy of the password hashes, no rate limit applies: they test guesses on their own hardware. The speed now depends on the hash function the site used. Rounded figures from public hashcat benchmarks for one current high-end consumer GPU:
| Storage | Guesses per second (1 GPU) |
|---|---|
| MD5 (unsalted, still found in old systems) | ~160 billion |
| SHA-256 (fast, not designed for passwords) | ~22 billion |
| bcrypt, cost 10 (a common default) | ~5,700 |
Modern password hashes such as bcrypt, scrypt and Argon2 are deliberately slow, which is why they cut the attacker’s speed by a factor of about 28 million. Our guide on how password cracking works covers why.
Table 1: time to crack, MD5, one GPU
The worst common case: a site that stored passwords with a fast hash.
| Length | Digits only (0-9) | Lowercase letters | Upper + lowercase | Letters + digits | Letters + digits + symbols |
|---|---|---|---|---|---|
| 6 | instantly | instantly | instantly | instantly | 2.2 seconds |
| 8 | instantly | instantly | 2.8 minutes | 11 minutes | 5.3 hours |
| 10 | instantly | 7.4 minutes | 5.2 days | 30 days | 5.3 years |
| 12 | 3.1 seconds | 3.5 days | 39 years | 319 years | 47,128 years |
| 14 | 5.2 minutes | 6.4 years | 104,663 years | 1.2 million years | 416 million years |
| 16 | 8.7 hours | 4,318 years | 283 million years | 4.7 billion years | effectively never |
| 18 | 36 days | 2.9 million years | 765 billion years | effectively never | effectively never |
Table 2: time to crack, MD5, 1,000 GPUs
A well-funded attacker. Renting this much cloud GPU capacity for a day is within reach of criminal groups.
| Length | Digits only (0-9) | Lowercase letters | Upper + lowercase | Letters + digits | Letters + digits + symbols |
|---|---|---|---|---|---|
| 6 | instantly | instantly | instantly | instantly | instantly |
| 8 | instantly | instantly | instantly | instantly | 19 seconds |
| 10 | instantly | instantly | 7.5 minutes | 44 minutes | 1.9 day |
| 12 | instantly | 5 minutes | 14 days | 117 days | 47 years |
| 14 | instantly | 2.3 days | 105 years | 1,228 years | 416,424 years |
| 16 | 31 seconds | 4.3 years | 283,009 years | 4.7 million years | 3.7 billion years |
| 18 | 52 minutes | 2,919 years | 765 million years | 18 billion years | effectively never |
Table 3: time to crack, bcrypt (cost 10), one GPU
The same passwords, stored the way they should be.
| Length | Digits only (0-9) | Lowercase letters | Upper + lowercase | Letters + digits | Letters + digits + symbols |
|---|---|---|---|---|---|
| 6 | 1.5 minute | 7.5 hours | 20 days | 58 days | 1.9 year |
| 8 | 2.4 hours | 212 days | 149 years | 607 years | 16,944 years |
| 10 | 10 days | 392 years | 401,814 years | 2.3 million years | 150 million years |
| 12 | 2.8 years | 265,260 years | 1.1 billion years | 9 billion years | effectively never |
| 14 | 278 years | 179 million years | effectively never | effectively never | effectively never |
| 16 | 27,797 years | 121 billion years | effectively never | effectively never | effectively never |
| 18 | 2.8 million years | effectively never | effectively never | effectively never | effectively never |
Why your own password probably falls faster
Every table above assumes the password was chosen at random, so the attacker has no choice but to try every combination. Human-chosen passwords are never attacked that way. Cracking tools start with:
- Leaked password lists: hundreds of millions of real passwords from previous breaches. If yours is in one, it falls in seconds. Check with our breached password checker.
- Dictionaries plus rules: words, names, places, and sports teams, combined with the transformations people use: capital first letter, “a” to “@”, a year or “123” at the end, “!” last.
- Masks: templates such as “one capital, six lowercase, two digits, one symbol”, which cover a large share of passwords built to satisfy complexity rules.
So Summer2026! is 11 characters from all four types, which the tables would rate at about 500 years even on MD5, but it is among the first million guesses of any modern attack. Length only protects you when every character is random.
How long should your password be?
- Everyday accounts, stored in a password manager: 14–16 random characters. You never type it, so length is free.
- Email, banking, and admin accounts: 16 or more random characters, plus two-factor authentication.
- Passwords you must memorize (password manager, computer login, disk encryption): a passphrase of 6–7 random words or more. See passphrases vs passwords.
Try your own numbers in the crack time calculator, or get a random password from the password generator.
Key takeaways
- The attack scenario matters more than the password: a slow hash buys you a factor of about 28 million.
- Plan for the bad case, a stolen database with a fast hash: 12 random characters is the minimum that holds.
- The tables only apply to random passwords. Invented ones are cracked from patterns, not by brute force.