How Long Does It Take to Crack a Password in 2026?
The reference table: realistic crack times against modern GPU hardware at ten billion guesses per second – and the two rules that make a password effectively uncrackable.
Crack Time by Password Type (2026)
| Password type | Time to crack (offline, ~10 billion guesses/sec) |
|---|---|
| 6 characters, lowercase only | Instantly |
| 8 characters, lowercase only | Under 1 second |
| 8 characters, mixed case + numbers | About 5 minutes |
| 8 characters, mixed + symbols | About 1 hour |
| 10 characters, mixed + symbols | Around 8 months |
| 12 characters, mixed + symbols | Thousands of years |
| 14 characters, mixed + symbols | Millions of years |
| 4 random words (e.g. 20+ characters) | Effectively uncrackable |
| Any password already in a leak | Instantly – regardless of length |
Test your own (privately, in your browser) with the password strength checker.
What the Table Really Says
- Length beats cleverness. Each added character multiplies crack time by the size of the character set – the jump from 8 to 12 characters is the difference between an hour and millennia.
- Substitutions do not help much. P@ssw0rd-style tricks are built into every cracking dictionary.
- Leaked passwords have zero crack time. Attackers try leaked email-password pairs first; a unique password per site is non-negotiable.
- The practical answer: a password manager generating 20-character random strings, plus two-factor authentication on email and banking.
Methodology
Times assume an offline attack on a standard fast hash at ten billion guesses per second, in line with publicly documented performance of current high-end GPU cracking rigs in 2026. Online attacks against rate-limited services are far slower; passwords found in breach corpora fall instantly regardless of complexity. This table may be cited with a link to this page.
