How Long Would It Take to Crack Your Password?

Your 8-character password falls in minutes. A 16-character passphrase survives centuries. The math of password cracking — and what to do about it.

How password cracking actually works

Forget the Hollywood image of a hacker typing furiously. Real password cracking is automated, and it comes in a few flavors:

• Brute force: trying every possible combination. A modern GPU can attempt tens of billions of guesses per second against a stolen password hash.
• Dictionary attacks: trying words, names, and common passwords first — including every leaked password from every breach ever, which attackers have compiled into lists of billions.
• Credential stuffing: taking your leaked email+password pair from one breach and trying it on every other site. This is why reuse is the real killer.
• Phishing and social engineering: skipping the math entirely by tricking you into handing over the password. No crack time applies.

The uncomfortable truth: if a site stores passwords properly (slow, salted hashes), even weak passwords survive a while. If it stores them badly — and breaches keep proving many do — everything is crackable and only time varies.

The math: how guess counts translate to time

Crack time is roughly (possible combinations ÷ guesses per second). At 10 billion guesses per second:

• 8 lowercase letters (208 billion combos): ~21 seconds
• 8 mixed-case + digits (~218 trillion combos): ~6 hours
• 12 mixed-case + digits + symbols: ~3,000 years
• 16 random characters: effectively forever

Notice the pattern: each added character multiplies the search space. Length is exponential armor; complexity is just a multiplier. A 16-character all-lowercase password (26¹⁶ ≈ 4×10²² combos) beats an 8-character symbol-soup password by an absurd margin — and it's easier to type.

Why "complexity rules" backfired

Corporate policies demanding "one uppercase, one digit, one symbol, changed every 90 days" produced exactly what you'd predict: Password1! → Password2! → Password3! — trivially guessable sequences that satisfy every rule. NIST, the US standards body, reversed course years ago: length over complexity, no forced rotation unless there's evidence of compromise. If your IT department still mandates quarterly changes, they're following 2003-era guidance.

Passphrases: the practical answer

Four or five random words — correct horse battery staple is the famous example — give you 60+ bits of entropy in something a human can actually remember and type. Our passphrase generator builds exactly these. They're long enough to be uncrackable, memorable enough to not need writing down, and they dodge every complexity-rule trap.

What matters more than password strength

Honest ranking of what actually protects your accounts:

1. Don't reuse passwords. One breach + credential stuffing defeats every strong password ever made. A password manager makes unique passwords effortless.
2. Turn on two-factor authentication (2FA) — ideally app-based or hardware keys, not SMS. 2FA makes a cracked password nearly useless.
3. Use long, unique passwords (this is where the article's advice lands — necessary but not sufficient alone).

A 40-character random password reused across twelve sites is less secure than twelve mediocre unique passwords with 2FA on the important ones.

Password managers: the thing that makes all of this easy

Every piece of advice above gets dramatically easier with a password manager — and dramatically harder without one. Humans can't memorize 100 unique 16-character passwords; password managers can, and they also:

• Generate strong passwords for you so you're never tempted by Fluffy2024! again.
• Autofill only on the real site, which quietly defeats most phishing — the manager won't fill your bank password into bank-secure-login-totally-legit.com.
• Sync across devices so the strong password you made on your laptop works on your phone.
• Flag reused and breached passwords in their built-in security audits.

The only password you need to memorize is the manager's master password — make it a long passphrase, turn on 2FA for the manager itself, and you're done. Pick any reputable one; the best password manager is the one you'll actually use.

Check whether you're already breached

Billions of credentials are circulating from past breaches. Plug your email into Have I Been Pwned (haveibeenpwned.com) — a free, reputable service — to see which breaches exposed your addresses. For every hit: change that password, make it unique, and check whether you reused it anywhere else (then change those too). Do this once a year like a dental checkup. Finding an old breach isn't a crisis — it's Tuesday on the internet — but ignoring it is how credential stuffing works.

Frequently asked questions