How long does it take to crack an 8-character password?

A random 8-character password using all character types (about 52 bits) falls in roughly 40 minutes to an offline GPU rig doing a trillion guesses per second, though it holds up fine against throttled online guessing. This is why 8 characters is no longer considered safe for anything important.

What crack speed do the scenarios assume?

Online throttled: 100 guesses/second. Offline slow hash (bcrypt/argon2): 100 thousand guesses/second. Offline fast hash (MD5/SHA1 on a modern GPU rig): 1 trillion guesses/second. Real attackers land in between depending on hardware and how the site stored your password.

Does this apply to human-made passwords?

No; this calculator models truly random passwords. Human-made passwords follow patterns attackers try first, so they fall orders of magnitude faster. Test a real password’s pattern weaknesses in our strength checker instead.

Password Crack Time Calculator

Dial in a length and character set, get survival times against three realistic attacks. No password required.

Runs entirely in your browser. Nothing you type or generate is ever sent to a server.

Length: 12

lowercase UPPERCASE digits symbols

Symbols here are the 26 our generator uses, so all four sets together give a pool of 88. The full printable-ASCII set has 32 symbols and a pool of 94, which is the figure our articles quote; this tool deliberately reports the smaller, more conservative number.

Online (throttled)
Offline, slow hash
Offline, GPU rig

How crack time is calculated

A truly random password of length L over a pool of N characters has N^L equally likely possibilities, or L x log2(N) bits of entropy. An attacker finds it, on average, after searching half the space. Divide those guesses by the attacker's speed and you get the times above. The GPU scenario assumes a leaked database of fast hashes, the situation your password must actually survive, because you do not get to choose how a site stores it.

What the math tells you to do

Length beats complexity. Adding 4 lowercase letters helps more than swapping in 2 symbols; each character multiplies the space.
12 random characters from the full pool survives centuries even on the GPU scenario; 16 is overkill in the best way.
Human passwords are not random, so treat these numbers as a ceiling; the strength checker models the human patterns.

Ready to fix a weak one? The generator makes a random password at whatever length this calculator convinces you of.

Frequently asked questions

How long does it take to crack an 8-character password?: A random 8-character password using all character types (about 52 bits) falls in roughly 40 minutes to an offline GPU rig doing a trillion guesses per second, though it holds up fine against throttled online guessing. This is why 8 characters is no longer considered safe for anything important.
What crack speed do the scenarios assume?: Online throttled: 100 guesses/second. Offline slow hash (bcrypt/argon2): 100 thousand guesses/second. Offline fast hash (MD5/SHA1 on a modern GPU rig): 1 trillion guesses/second. Real attackers land in between depending on hardware and how the site stored your password.
Does this apply to human-made passwords?: No; this calculator models truly random passwords. Human-made passwords follow patterns attackers try first, so they fall orders of magnitude faster. Test a real password’s pattern weaknesses in our strength checker instead.