You have seen the charts. A grid of password lengths down one side, character types across the top, and cells coloured from red to green with times ranging from "instantly" to "34,000 years". They are shared constantly, they are printed and pinned to office walls, and they are missing the single most important variable.
The number those charts leave out
Crack time is not a property of your password. It is a property of your password and the attacker, and the attacker side varies enormously more than the password side.
Take one 12-character random password and run it against five realistic scenarios:
| Who is attacking | Guesses per second | Time to crack |
|---|---|---|
| A login form that locks you out | 0.1 | 26 quadrillion years |
| An API with no rate limiting | 1,000 | 2.6 trillion years |
| A leak, hashed properly with bcrypt | 100,000 | 26 billion years |
| A leak, hashed with MD5 | 1 trillion | 2,600 years |
| A nation-state budget | 1 quintillion | 23 hours |
Same password. From "longer than the universe" to "before lunch tomorrow". Nothing about the password changed — only who was trying.
This is the part that should actually worry you: the variable that matters most is not yours to control. Whether a site stored your password with bcrypt or with MD5 decides four orders of magnitude of your safety, and you will never know which until the breach is announced. You can see the effect by switching attackers in the password generator — the number swings while the password sits there unchanged.
Where the guess rates come from
The two ends of that table are worth explaining, because they are the ones people find implausible.
The fast-hash number is measured, not estimated. A single current high-end consumer GPU computes roughly 164 billion MD5 hashes per second in published hashcat benchmarks. Eight of them, rentable by the hour for a few dollars, gets you to a trillion. If a breached site used MD5 or SHA-1 — and many still do — this is the realistic attacker, not a hypothetical one.
The nation-state number is extrapolated, because no such machine has been publicly demonstrated. It is anchored to something real though: the Bitcoin network sustains on the order of 880 exahashes per second of purpose-built SHA-256 silicon. A quintillion guesses per second is about a thousandth of hardware humanity has already built for an unrelated purpose. That makes it a defensible ceiling rather than a scary guess.
Length beats complexity, and it is not close
Here is the same attacker — the leaked-database-with-a-fast-hash case — against different lengths of random password:
- 6 characters — 2 seconds
- 8 characters — 4 hours
- 10 characters — 4 years
- 12 characters — 26,000 years
- 16 characters — 1.4 trillion years
Each additional character multiplies the work by the size of the character set. Adding four characters to a 12-character password does far more than adding every symbol on your keyboard to an 8-character one. If a site rejects symbols, shrug and make it longer.
Why the charts are optimistic about human passwords
Every number above assumes the attacker guesses uniformly at random — that they have no idea what your password looks like and must work through the space blindly.
Real attackers do nothing of the sort. They start with the hundred million passwords already leaked from previous breaches. Then dictionary words. Then dictionary words with a capital at the front and a number at the end, because that is what password rules produce. Then the predictable letter-to-digit swaps.
So Password123! scores 78 bits by the naive formula and falls in well under a second in reality, because it is near the front of every list ever assembled. The charts are accurate for passwords a machine generated at random. They are wildly optimistic for passwords a person invented.
This is also why a good strength meter is pattern-aware: it looks for dictionary words, keyboard runs, repeats and years, and prices the cheapest way to describe your password rather than pretending each character was random.
What brute force is not
Worth ending here, because optimising the wrong thing is the common mistake.
Almost nobody loses an account to brute force. They lose it to credential stuffing: a forum they signed up to in 2016 gets breached, and the attacker tries that same email and password against their bank. Password strength is completely irrelevant in that scenario — a 40-character random string that appeared in a breach falls on the first guess. Reuse is the vulnerability, and a unique password per site is the fix, which in practice means a password manager.
The other common route is phishing, where you type the password into a convincing fake yourself. Again, length does nothing. Two-factor authentication is what limits the damage, and switching it on does more for your security than any amount of extra entropy.
Crack time is a useful thing to understand and a bad thing to obsess over.
If you want to see the swing for yourself, the password generator shows the crack time live against all five attackers, and you can drag the length slider and watch the number move through several orders of magnitude. It also has a tab for testing a password you already use — pattern-aware, so it will tell you plainly if yours is a dictionary word with a year stuck on the end. Nothing is transmitted; it all runs in your browser.
The natural follow-up is whether a passphrase is better than a password, since four random words are much easier to type on a phone than sixteen random characters. Passwords vs passphrases works through where each one actually wins — the answer turns on how the words are chosen, not on how long the result is.
Frequently asked questions
How long does it take to crack a 12-character password?
Against a leaked database hashed with a fast algorithm like MD5, roughly 2,600 years for a truly random 12-character password. Against a rate-limited login form, effectively forever. Against a nation-state attacking a fast hash, about a day.
Are password crack time charts accurate?
They are accurate for randomly generated passwords and badly optimistic for human-chosen ones. They assume uniform guessing; real attackers try leaked passwords, dictionary words and predictable substitutions first, so a human password falls far sooner than the chart says.
Is a longer password better than a more complex one?
Yes, and by a wide margin. Adding four characters to a 12-character password beats adding every symbol on the keyboard to an 8-character one. If a site rejects symbols, just make the password longer.
What does "bits of entropy" mean for a password?
It is how many guesses an attacker needs, expressed as a power of two — each extra bit doubles the work. Below about 40 bits a password falls to a determined offline attack. Above about 80, brute force stops being the realistic threat.
If my password is strong, am I safe?
Not on its own. Most account compromises come from reuse after an unrelated site is breached, or from phishing — and password strength helps with neither. A unique password per site plus two-factor authentication matters more than extra length.
Last updated September 19, 2026