See how long a brute-force attack would take against a password, from a rate-limited login form to a stolen database attacked with a GPU cluster. Type a password, or pick a length and character set.
Privacy: everything is calculated in your browser. Nothing you type is sent anywhere.
Random passwords using letters, digits and symbols (94 characters), one high-end GPU, average case.
| Length | bits | MD5 | bcrypt |
|---|---|---|---|
| 6 | 39 | 2.2 seconds | 1.9 year |
| 8 | 52 | 5.3 hours | 16,944 years |
| 10 | 66 | 5.3 years | 150 million years |
| 12 | 79 | 47,128 years | effectively never |
| 14 | 92 | 416 million years | effectively never |
| 16 | 105 | effectively never | effectively never |
A password chosen at random from N possible characters with length L can take NL values. On average an attacker finds it after trying half of them, so the expected time is NL ÷ 2 ÷ guesses per second. The guess rate is what changes everything:
You rarely know how a site stores your password, so plan for the bad case: a stolen database hashed with a fast algorithm. A random 12-character password survives that; an 8-character one does not.
When you type a password, this calculator measures how big its character set and length are. That is an upper bound. Cracking tools don’t start with brute force: they start with leaked passwords, dictionaries, names, and rules like “capitalize the first letter and add a year”. Summer2026! looks like 72 bits but falls in minutes. Only passwords produced by a random generator actually reach the strength shown here. For the full method see how long it takes to crack a password.
A random 8-character password from all 94 printable characters has about 52 bits of strength. Against a fast MD5 hash, one GPU needs about 5 hours on average; against bcrypt it needs about 17,000 years. Online with rate limiting, it is out of reach.
12 random characters or more for everyday accounts (about 79 bits with all character types), 16 or more for anything critical. With a password manager the length costs you nothing.
They are rounded from public hashcat benchmarks for a current high-end consumer GPU. Exact speeds vary by card and driver; the order of magnitude is what matters.