How Long Would It Take to Crack Your Password? (2026 Table)

"Use at least 8 characters with a capital letter, a number and a symbol." That rule shaped a generation of passwords like Summer2026! — and it is exactly the kind of password that falls fastest today. Here is how long different passwords really survive, the simple maths behind it, and a recipe for passwords that are both strong and easy to live with.

The table

These times assume an attacker has stolen a database of password hashes and is guessing offline with a powerful graphics-card setup at 100 billion guesses per second — realistic for fast, older hash types. The times are for trying every possible combination; on average a password falls in about half that time.

Two important notes:

• These numbers only apply to truly random passwords. The examples above are for illustration; a password you invent yourself is far weaker than its length suggests (see below).
• Websites that store passwords properly (with slow hashing such as bcrypt or Argon2) make guessing thousands of times slower. You just can't know which websites do.

The maths in one sentence

Every extra character multiplies the number of combinations by the size of the character set (26 for lowercase, 62 for letters and digits, about 94 when you add symbols). That is why length beats complexity: going from 8 to 12 characters multiplies the work by about 78 million, while adding symbols to an 8-character password multiplies it only by about 28.

Why P@ssw0rd2026! is weak even though it "has everything"

Cracking software doesn't try combinations in alphabetical order. It starts with:

1. Leaked passwords — billions of real passwords from past data breaches.
2. Dictionary words with common changes — a→@, o→0, a capital first letter, a year or ! at the end.
3. Keyboard patterns — qwerty, 1qaz2wsx, zxcvbn.

A password built from a word plus predictable tweaks is found in the first steps, long before the "all combinations" figure in the table matters. Only randomly generated passwords get the full protection shown above.

The real danger: reusing a password

Most accounts are not broken by cracking at all. They are broken by credential stuffing: attackers take email-and-password pairs leaked from one website and try them automatically on email, banking and shopping sites. If you use the same password in two places, the weaker site decides how safe the stronger one is. One unique password per account matters more than any rule about symbols.

What the official guidance says now

The US standards body NIST (guideline SP 800-63B) changed its advice years ago, and the current version goes further:

• Length matters most. Long passwords and passphrases are encouraged.
• No forced complexity rules (such as "must contain a symbol").
• No forced changes every 90 days — only change a password when there's a sign it was exposed.
• Check new passwords against lists of breached passwords.

A simple recipe you can actually live with

1. Use a password manager so you only remember one password.
2. For every account inside the manager: a random password of 16 characters or more. You never type it, so length costs you nothing.
3. For the master password (and your computer login): a 6-word random passphrase. It is long, strong, and much easier to type and remember than x7#Kq!2m.
4. Turn on two-factor authentication for email and banking. Even a stolen password is then not enough.
5. Check whether your email appears in known breaches on a service like Have I Been Pwned, and change any reused password there first.

Be careful with online "password strength checkers"

Typing your real password into a website to test it is exactly the habit attackers hope for. Test the style of password you plan to use, not the real one — or use a tool that runs on your own computer.

Generate strong passwords offline

PassCraft is a free Windows password and passphrase generator that works entirely offline. Choose the length and character types for random passwords, or generate word-based passphrases that are easy to type — nothing is ever sent over the internet.

Frequently asked questions

Is a 12-character password enough?

A random 12-character password with all character types is very strong today. For passwords stored in a password manager, 16 or more characters costs you nothing, so go longer.

Are passphrases really as strong as random passwords?

Yes, when the words are chosen randomly from a large list. Six random words are roughly as strong as a random 12-character password, and far easier to remember. A famous quote or song lyric is not random and is weak.

How often should I change my passwords?

Only when there is a reason: a breach, a shared password, or a suspicion that someone else knows it. Forced regular changes lead people to make predictable tweaks, which weakens passwords.

What is the most secure type of password?

A long, randomly generated password that is unique to one account and stored in a password manager, combined with two-factor authentication.

Do symbols make a password stronger?

A little. Adding length makes it much stronger. When a site limits length, then use every character type it allows.

Make your next password properly random: download PassCraft for free — passwords and passphrases generated offline on your PC.