How long to crack a password

How long it takes to crack a password depends on three things: how many possible passwords there are (length and character types), how fast an attacker can test guesses, and whether the password is random at all. A random 8-character lowercase password stored with a slow hash can fall in a couple of weeks on rented graphics cards; a random 16-character password with mixed characters would take longer than the age of the universe. The free password generator makes the random, long kind on your device.

The famous colour-coded tables you see shared online are useful, but they rest on assumptions. Knowing those assumptions tells you what really keeps an account safe.

What "cracking" actually means

When you sign up somewhere, a well-run site doesn't store your password. It stores a hash: a scrambled fingerprint of it. When you log in, the site hashes what you type and compares fingerprints. The free hash generator shows the idea: type password123 and its MD5 hash is 482c811da5d5b4bc6d497ffa98491e38, every time, on every computer.

If a site's database is stolen, attackers get the hashes, not the passwords. Cracking means guessing passwords, hashing each guess, and checking for a match, offline, as fast as their hardware allows. No website lockout slows them down.

That's why two things decide the time:

1. The number of possibilities the attacker may have to try.
2. The guessing speed, which depends heavily on the hash method the site used.

The brute-force maths

The number of possible passwords is the size of the character set raised to the power of the length.

Character set	Characters
Digits only	10
Lowercase letters	26
Lowercase + uppercase + digits	62
All four types in our generator	85

An 8-character lowercase password has 26^8, about 209 billion, possibilities. With all 85 characters, 8 characters give about 2.7 × 10^15. Each extra character multiplies the total by the size of the set, which is why length beats everything else.

What the latest table says

As per Hive Systems' 2026 password table, a fleet of 16 RTX 5090 graphics cards attacking passwords stored with bcrypt (a deliberately slow hash, at work factor 10) managed about 138,675 guesses a second. At that rate, they estimate an 8-character lowercase password takes about two weeks to crack, and an 8-character password using all character types about 132 years. Their times are worst cases, where the right password is the very last guess.

Using that same guessing speed and the generator's 85-character set, here's the worst-case time we calculate for random passwords:

Length	Lowercase only (26)	All four types (85)
6	about 37 minutes	about 32 days
8	about 17 days	about 620 years
10	about 32 years	about 4.5 million years
12	about 22,000 years	about 32 billion years
16	about 10 billion years	about 1.7 × 10^18 years

Our 8-character figure doesn't match Hive's because tables differ in character-set size, hash settings and how they count guesses; the point is the same. On average, the right guess comes about halfway through, so halve these numbers for a typical case.

Why the table can be far too kind

The table assumes the best case for you in two ways.

The site might use a fast hash. bcrypt is built to be slow. Old or careless systems use fast hashes like MD5 or plain SHA-1, which a single graphics card can test billions of times a second. Against those, the times above shrink by a factor of a million or more. You can't tell how a site stores your password, so assume the worse case. The guide to MD5 vs SHA-256 explains the difference.

Your password might not be random. Brute force is the slowest attack. Real cracking starts with lists of leaked passwords, dictionary words, names, dates and common patterns like Password123! (capital first, number and symbol at the end). A password built that way is found in seconds no matter how many character types it has, because attackers try those patterns first.

It might already be leaked. If you reuse a password and any site you used it on is breached, attackers don't need to crack anything. They simply try the same email and password on other sites.

What actually keeps you safe

• Length and randomness. A random password of 16 characters or more is beyond brute force for any realistic attacker. As per NIST's SP 800-63B (revision 4, 2025), services that rely on a password alone should require at least 15 characters, and shouldn't force composition rules or regular changes.
• A unique password for every site. This defeats reuse attacks completely.
• A password manager. It remembers dozens of long random passwords so you don't have to. Then length costs you nothing.
• Two-factor authentication. Even if a password is cracked, the attacker still needs your phone or security key. Turn it on for email, banking and social accounts first.

If you need a password you can remember and type, such as your password manager's master password, a long passphrase of random words is a good fit. See passphrase vs password.

Make one that won't be cracked

Open the free password generator, set Length to 16 or more (it starts at 20), keep Lowercase, Uppercase, Numbers and Symbols ticked, press Generate and then Copy. The password is created on your device and never sent anywhere. For more on the settings, see how to create a strong password.