PasswordSecure.org
How long does it take to crack your password?
The full table by length and character set, with the calculation explained.
This question has an exact answer, and it does not depend on luck: it depends on how many possible passwords there are and how many an attacker can try per second. Here is the full table, with the entire calculation below so you can check it yourself.
The table
Average time to guess by brute force, at 10 billion guesses per second. Entropy in bits shown in brackets.
| Length | Lowercase only | Upper + lowercase | Letters + numbers | With symbols |
|---|---|---|---|---|
| 6 | Instant (28b) | Instant (34b) | 2 seconds (35b) | 27 seconds (39b) |
| 8 | 7 seconds (37b) | 29 minutes (45b) | 2 hours (47b) | 3 days (52b) |
| 10 | 2 hours (47b) | 3 months (57b) | 11 months (59b) | 59 years (65b) |
| 12 | 1 month (56b) | 5 centuries (68b) | 38 centuries (71b) | 4,858 centuries (78b) |
| 14 | 59 years (65b) | 9,717 centuries (79b) | 155,469 centuries (83b) | Infeasible (91b) |
| 16 | 607 centuries (75b) | Infeasible (91b) | Infeasible (95b) | Infeasible (104b) |
| 18 | 310,938 centuries (84b) | Infeasible (102b) | Infeasible (107b) | Infeasible (117b) |
| 20 | Infeasible (94b) | Infeasible (114b) | Infeasible (119b) | Infeasible (130b) |
"Infeasible" means over a million centuries: for all practical purposes, the password will not fall to brute force.
How it is calculated
Only three things are needed.
1. The size of the character set
- Lowercase only: 26 possibilities per character
- Upper and lowercase: 52
- Letters and numbers: 62
- Letters, numbers and symbols: 92
2. The entropy
This is the number of bits needed to describe every possible combination:
entropy = length × log2(character set)
A 16-character password with symbols gives 16 × log2(92) = 104 bits. Every extra bit doubles the attacker's work, which is why the table escalates so quickly.
3. The attack speed
We assume 10 billion guesses per second, which corresponds to an offline GPU attack against a fast hash (such as unsalted MD5 or SHA-1). That is the scenario where an attacker has stolen a service's database and works on it on their own hardware, with no rate limiting.
The average time is half the total space: 2(bits−1) ÷ 1010 seconds. Half, because on average you hit it halfway through.
Why this table is optimistic
Here is the catch almost no table on the internet mentions: all of the above only holds if your password is genuinely random.
Nobody brute-forces blindly if they can avoid it. Attackers start with dictionaries, leaked password lists and transformation rules (swap "a" for "@", append "123", capitalise the first letter). Against that, length will not save you:
Springtime2026!has 15 characters, upper and lowercase, a number and a symbol. By the table that would be thousands of centuries. In practice it falls in minutes, because it is a dictionary word with a predictable pattern.P@ssw0rd123looks complex and has been in every attack list for over a decade.
The table describes the best case: what you get when the password was generated at random and contains no structure an attacker can exploit.
What to do with this
- Favour length over complexity. Look at the table: 16 lowercase-only characters (75 bits) outlast 8 with symbols (52 bits). Adding one character buys more than adding one character type.
- Make it genuinely random. If you thought it up yourself, it has patterns, even when it does not look like it. Use a generator.
- Never reuse it. Once a password leaks anywhere, it joins the attack lists and its theoretical strength stops mattering everywhere else.
- 12 characters minimum, 16 for what matters. Your main email, your bank and your password manager deserve 16 or more.
Check yours
Our password checker applies exactly this calculation, and additionally detects dictionary patterns and checks whether your password has appeared in real breaches. All inside your browser: the password never leaves your device.
If you would rather have something memorable, the passphrase generator reaches 77 bits with six words.