Password crack time estimates are thrown around a lot, but they’re often misleading — calculated against unrealistic hardware assumptions or without accounting for real-world attack methods. Here are honest, grounded numbers based on how attacks actually happen, and why the same 12-character password can be “uncrackable” in one scenario and gone in minutes in another.

Two Very Different Attack Scenarios

Crack time depends almost entirely on the attack scenario, not just the password. There are two fundamentally different situations:

• Online attacks — The attacker is trying passwords against a live login form. Rate limiting, account lockouts, and CAPTCHAs slow these attacks to perhaps 10–100 attempts per second at most. A 6-digit PIN takes seconds to crack offline; online, it might take days or be stopped by lockout after 10 tries.
• Offline attacks — The attacker has a copy of the hashed password database (from a breach) and is running cracking software on their own hardware with no rate limiting. A modern GPU cluster can test billions of passwords per second against MD5 hashes. This is the scenario that makes password strength genuinely matter.

When security researchers talk about crack times, they’re almost always discussing offline attacks, which is the correct frame — because this is what happens after a database breach, and it’s the scenario where your password’s inherent strength is the only thing standing between an attacker and your account.

Why Online Rate Limiting Isn’t a Safety Net

It’s tempting to assume that a slow, rate-limited login form makes password strength less important. In practice, this protection disappears the moment any service you use is breached and the hash database is stolen — at that point every account becomes an offline-attack target, regardless of how well the original site rate-limited logins. You can’t control whether a service gets breached; you can only control whether your password survives the aftermath.

The Real Numbers by Password Length and Type

Against a modern GPU cracking rig targeting MD5 hashes (roughly 100 billion guesses per second for simple passwords):

• 6 characters, lowercase only: Under 1 second
• 8 characters, mixed case + numbers: Minutes to hours
• 10 characters, mixed case + numbers + symbols: Weeks to months
• 12 characters, random mixed: Decades
• 16 characters, random mixed: Centuries
• 6-word diceware passphrase: Longer than the age of the universe (against pure brute force)

These estimates apply to random passwords. Passwords following predictable patterns (dictionary words, common substitutions, known formats) are cracked much faster because attackers use dictionary attacks and rule-based attacks, not just brute force. A “complex” 12-character password based on a dictionary word with common substitutions might fall in minutes.

How Dictionary and Rule-Based Attacks Change Everything

Modern password cracking doesn’t try every possible character combination. Tools like Hashcat use:

• Dictionary attacks — Testing millions of known words, names, and phrases
• Rule-based mutations — Applying known modification patterns (capitalize first letter, add number at end, replace letters with symbols)
• Hybrid attacks — Dictionary words combined with brute-force segments
• Markov chain attacks — Generating statistically likely character sequences based on how humans create passwords

These techniques mean that “P@ssw0rd1” — which looks complex to a human — is likely in the first few thousand guesses of a good dictionary attack because that exact transformation pattern is well-known.

A Worked Example

Take the password “Dragon2026!”. By raw character count and composition it has 11 characters, mixed case, a number, and a symbol — the kind of password many complexity meters would rate favorably. But “dragon” is a top-500 dictionary word, “2026” is a highly predictable current-year append, and “!” at the end is the single most common symbol placement. A hybrid attack combining a small dictionary with year-append rules would test this exact combination within the first few million guesses — a process that takes seconds on consumer hardware, despite the password’s apparent complexity.

The Effect of Hashing Algorithm

How the password was stored matters as much as the password itself. Against bcrypt (a slow hashing algorithm designed for passwords), the same GPU rig might only test thousands of passwords per second instead of billions. Many older or poorly-built applications still use fast hash algorithms (MD5, SHA1) that provide nearly no protection against offline cracking.

This is entirely outside your control as a user — you can’t see what hashing algorithm a site uses internally. The practical implication is that you should assume the worst-case (a fast, weakly-protected hash) for every account, and rely on your password’s own length and randomness as the real defense, rather than trusting that the site did its job properly.

Crack Time by Hashing Algorithm — A Comparison

Notice that even against a fast, poorly-chosen hash algorithm, a genuinely random 12-character password still takes decades to crack. The real danger isn’t hash choice on its own — it’s combining a weak hash with a predictable, human-created password, which is exactly the combination breach databases show most often.

Why “Time to Crack” Calculators Can Be Misleading

Many online password strength meters give a crack time estimate based purely on brute-force math against your password’s character set and length — completely ignoring whether the password follows a dictionary pattern. This means a meter might rate “Tr0ub4dor&3” (a real example from a well-known XKCD comic) as requiring centuries to crack via brute force, while a dictionary-aware hybrid attack recovers it far faster because the underlying word and substitution pattern are common. Always treat “brute-force-only” crack time estimates as a best-case ceiling, not a realistic estimate — the real risk is almost always dictionary and rule-based attacks, not pure brute force.

Crack Time by Character Set — Full Reference Table

These figures assume a genuinely random password against a fast (unsalted or weakly-hashed) offline attack — the worst realistic case for you as the defender, and the case you should plan around since you can’t verify how any given site actually stores your password.

A Second Worked Example: Why “Random-Looking” Isn’t the Same as Random

Consider “Qwerty!2026” — 11 characters, mixed case, a symbol, and a number, which checks every box a typical complexity meter looks for. But “Qwerty” is a keyboard-walk pattern near the top of every wordlist, “!” is the single most common appended symbol, and “2026” is the current year. A rule-based hybrid attack testing keyboard-walk words with year-append rules would recover this password in a fraction of a second on consumer hardware, despite it superficially resembling a strong password. Compare this to “vX9$mQ2#nL7w” — also 11-12 characters, but generated by truly random selection with no underlying word, pattern, or personal reference. That password has no shortcut; an attacker is forced into genuine brute force, which at this length takes decades even on high-end GPU clusters. The visual “complexity” of both passwords looks similar to a human. Their actual crack times differ by orders of magnitude, because one has an exploitable pattern and the other doesn’t.

What Security Researchers Actually Measure

When researchers publish crack-time studies, they typically test against real leaked password databases rather than theoretical random strings, because that’s what represents genuine attacker behavior. Studies analyzing tens of millions of breached passwords consistently find that a large majority can be recovered within the first hour of a dictionary-plus-rules attack — not because the passwords were short, but because they followed a small number of common structural patterns (word + number, name + symbol, keyboard walk + digit). The passwords that survive these studies for the longest are, without exception, either password-manager-generated random strings or genuinely random multi-word passphrases. This is the strongest available evidence that structure, not just length or character variety, determines real-world crack time.

Testing Your Password’s Resistance

The Password Strength Test gives you crack time estimates across four real attack scenarios — brute force, dictionary, hybrid, and GPU cluster — based on your password’s characteristics. You describe the password type and length rather than entering the actual password, so your credentials are never exposed.

The Practical Takeaway

For passwords that are stored by third-party services (which you can’t control), length and randomness are your primary defenses. Aim for 16+ random characters managed by a password manager. For truly critical accounts — your email, your password manager master password — add 2FA so that even if the password is cracked, it’s useless without the second factor.

It’s worth remembering that crack-time math only describes one stage of an attack. Even an effectively uncrackable password doesn’t protect you from phishing, where you hand over the plaintext directly, or from malware that logs your keystrokes as you type. Strong, unique, manager-generated passwords combined with 2FA and basic phishing awareness cover the realistic range of ways accounts actually get compromised — no single defense handles all of them alone.

Frequently Asked Questions

Q: If a password would take “centuries” to crack, am I completely safe?

A: Only against brute force. That estimate assumes the attacker has to guess every character combination. If your password is a dictionary word or predictable pattern, dictionary and hybrid attacks can bypass that estimate entirely and crack it in seconds, regardless of what a brute-force calculator says.

Q: Does adding one extra character really make that much difference?

A: Yes, dramatically. Because crack time scales exponentially with length, each additional random character multiplies (not adds to) the total search space — going from 11 to 12 characters can turn a “months” estimate into a “decades” estimate.

Q: Are online password strength meters accurate?

A: Only partially. Most estimate resistance to brute force but don’t account for dictionary and rule-based attacks, which are how most real-world passwords are actually cracked. Treat their estimates as an optimistic ceiling, not a guarantee.

Q: How fast can an attacker crack a 4-digit PIN?

A: Offline, instantly — there are only 10,000 possible combinations. Online, with rate limiting and lockouts, it can take much longer, but you shouldn’t rely on that protection since breach databases bypass it entirely.

Q: Does the type of account (email vs. a random forum) change how much crack-time matters?

A: Not as much as people assume. A “low-value” account’s breach can still expose your password for credential-stuffing against high-value accounts if you reused it. Crack-time resistance matters everywhere you have a unique password; it matters even more if you’ve reused a password anywhere.

Related Reading

• The Most Common Passwords (And Why They Never Go Away)
• How to Create a Strong Password (Step-by-Step Guide)
• How Hackers Actually Crack Passwords
• Password Manager vs. Memorizing Passwords: Which Wins?
• Try our free Password Strength Test →