How Long Would It Take a Hacker to Crack Your Password?

How long would it take a hacker to crack your password? For a surprising number of passwords the honest answer is "less time than it takes to read this sentence". The chart below shows how long it takes to try every possible password of a given length and style, so you can see exactly where yours sits and what it takes to push it out of reach.

How long to crack your password: the chart

These times assume a powerful attacker making 100 billion guesses per second, which is realistic for a rig of modern graphics cards attacking a stolen, weakly protected password database. They show the time to try every combination; on average, a password falls in about half that time. "All characters" means letters, numbers and symbols; "mixed case" means upper and lowercase letters.

The big lesson: length wins. Going from 8 to 12 characters turns an afternoon's work into centuries. Adding symbols helps, but not nearly as much as adding a few extra characters.

The catch: these times are for random passwords

The chart only applies if your password is truly random, like Tq7!vR2m#Lp9. Real people rarely choose passwords that way, and attackers know it.

Before trying every combination, cracking software works through:

1. Passwords leaked in past data breaches, billions of them.
2. Dictionary words and names in every common language.
3. Predictable patterns: a capital first letter, a year or "123" on the end, "@" instead of "a", keyboard runs like "qwerty".

So if you use Summer2026!, a hacker doesn't need long to crack your password. It technically has 11 characters with upper case, lower case, numbers and a symbol, which the chart puts at centuries, but it's on the first pages of every cracking list and falls instantly. The same goes for your name plus your birth year, your pet's name, or a favorite football club followed by a number.

Why some sites keep you safer than the chart suggests

The chart shows a worst case. In practice:

• Online attacks are far slower. A hacker guessing directly on a login page is usually limited to a handful of attempts before being slowed down or locked out.
• Good websites use slow hashing. Methods like bcrypt or Argon2 deliberately make every guess expensive, which can cut an attacker's speed from billions of guesses per second to thousands.
• Two-factor authentication means a cracked password alone isn't enough to get in.

But you can't see how a website stores your password, so it's safest to assume the worst case and make your password strong enough on its own.

How to make a password that's actually safe

• Use at least 12 characters, ideally 16 or more. It's the single biggest factor in the chart.
• Make it random. A password generator or random words beat anything you invent yourself. Our free password generator creates random passwords in your browser; nothing is sent anywhere.
• Or use a passphrase of random words. Four random common words (picked by dice or a generator, not by you) would take a rig like this about 10 hours to exhaust in the worst case, while six words would take about 70,000 years. The EFF's dice-generated passphrase method explains how to make one.
• Never reuse a password. When one site is breached, attackers immediately try the same email and password everywhere else.
• Use a password manager so every account can have a long, unique password without you remembering any of them.
• Turn on two-factor authentication or passkeys wherever you can.

Our guide on how to create a strong password covers these steps in more detail, and the US standards body NIST's digital identity guidelines explain why length and screening against leaked passwords matter more than complex rules.

Quick recap

• At 100 billion guesses a second, random 8-character passwords fall in minutes to hours; random 12-character ones take centuries or more.
• Real-world passwords built on words, names and patterns can be cracked almost instantly, whatever their length.
• Length and randomness beat symbols. Aim for 16 random characters, or a long passphrase of random words.
• Never reuse passwords, and add two-factor authentication or passkeys for real protection.