Understanding Password Crack Times
When we talk about how long it takes to crack a password, we're measuring the time required to systematically try every possible combination until finding the correct one. This password crack time depends on two factors: the total number of possible passwords (combinations) and the speed at which an attacker can test guesses. Understanding this relationship is crucial for creating passwords that will remain secure for years to come.
The Math Behind Crack Times
Password combinations grow exponentially with length. A password using lowercase letters (26 options) with 8 characters has 26^8
=
208 billion
combinations. With 12 characters, that becomes 26^12 =
95 quadrillion
. Adding character types multiplies this further—using all 95 printable ASCII characters gives 95^8 =
6.6 quadrillion
combinations for just 8 characters. Use our entropy calculator to see these numbers for your specific passwords.
Attack speed varies dramatically by context. A web application might limit you to a few attempts per second with lockouts. An offline attack against a leaked database with weak hashing can achieve billions of guesses per second per GPU. That's why our calculator shows multiple scenarios—your password's security depends heavily on what it's protecting and how it's stored.
Why Estimates Can Be Misleading
Our crack time calculator assumes a pure brute force attack with no shortcuts—the most favorable scenario for defenders. Real attackers don't work this way. They start with dictionaries of common passwords, then try variations and patterns. A password like "Summer2024!" might have 11 characters from a 95-character set (theoretical crack time: centuries), but it follows predictable patterns that attackers exploit with tools like Hashcat and John the Ripper.
This is why randomly generated passwords are essential. Human-created passwords contain exploitable patterns even when we try to be random. For passwords you need to remember, randomly generated passphrases provide the best combination of security and memorability.
The Role of Password Hashing
Services should never store your actual password—instead, they store a hash (one-way mathematical transformation). When you log in, they hash your input and
compare. Good hashing algorithms like bcrypt are deliberately slow, limiting attackers to thousands rather than billions of
guesses per second. Poor algorithms like MD5 offer no such protection.
Unfortunately, you can't know how a service stores your password. Some major breaches have revealed passwords stored in plain text. Always assume the worst case and use passwords strong enough to resist high-speed offline attacks. If our calculator shows your password could be cracked in less than centuries against GPU clusters, generate a stronger one.
Future-Proofing Your Security
Computing power roughly doubles every (Moore's Law). A password that takes 1000 years to crack today might take 500 years in , 250 years in , and so on. Quantum computers pose additional theoretical risks, though practical quantum password cracking remains years away. Build substantial safety margins into your password choices.
For important accounts, aim for crack times measured in millions or billions of years. This isn't paranoia—it's accounting for unknown vulnerabilities, future technology, and the possibility that your password hash might sit in a stolen database for years before being attacked. Check your current passwords and upgrade any that show crack times under "millennia" for critical accounts.