How long does it take to crack a password?
The answer depends almost entirely on two things: how the password is stored, and how long it is.
Two attack speeds, ten orders of magnitude apart
An online attack is guessing against a live login. Rate limiting and lockouts cap it at a handful of attempts per second at best, so a password with 40 bits of entropy is effectively unbreakable this way. An offline attack is guessing against a stolen hash on a machine you control, where a modern multi-GPU rig reaches 10^11 guesses per second against fast hashes.
Almost every 'password cracked in seconds' headline describes the second case. It matters because the same password can be safe on one site and catastrophic on another, purely because of how the site stores it.
Crack time by length
The table below assumes a full printable character set (88 characters, about 6.46 bits per character) and 10^11 guesses per second, with the attacker finding the password after searching half the space on average.
| Length | Entropy | Offline crack time |
|---|---|---|
| 8 | 52 bits | about 6 hours |
| 10 | 65 bits | about 2 months |
| 12 | 78 bits | about 40,000 years |
| 14 | 90 bits | about 300 million years |
| 16 | 103 bits | beyond meaningful measurement |
| 20 | 129 bits | beyond meaningful measurement |
Why length beats complexity
Adding one character multiplies the search space by 88. Adding a symbol class to a lowercase-only password multiplies it by about 1.35. That is the whole argument: length is the only lever with a large exponent.
This is also why mandatory complexity rules — one uppercase, one digit, one symbol — produce weaker passwords than length requirements. They push people towards predictable patterns like 'Password1!' while adding almost no entropy.
What actually gets passwords cracked
Brute force is the least common method in practice. Credential stuffing from other breaches, phishing, and guessing based on personal information account for far more account compromises. A 103-bit password reused across five sites is weaker in practice than a 60-bit password used once.
The ordering of defences is therefore: unique passwords first, a password manager second, length third, complexity last.
Frequently asked questions
Is 12 characters long enough?
For an online attack, comfortably. For an offline attack against a fast hash, 78 bits is at the edge of what is reachable with serious hardware. 16 is a better default.
Does a password with symbols crack slower?
Slightly. The character set grows from 62 to 88, raising entropy per character by about 8%. Four extra characters do far more.
Why do some sources say 8 characters takes seconds?
Because they assume a fast hash such as MD5 or SHA-1 and a single GPU. That is a realistic model for a badly built site, and an unrealistic one for bcrypt or Argon2.