How long would it take to crack my password?
From seconds to millions of years, depending on length, randomness and how a site stores it. Worked examples, why patterns ruin estimates, and a safe check.
Published
Tools for this job: Password Strength Checker · Password Generator
Password meters promise answers like “3 centuries”. Those numbers depend on assumptions: how the attacker gets to try guesses, how fast they can guess, and whether your password is truly random or follows a pattern people commonly use. Understanding the assumptions tells you what really keeps an account safe.
Two very different attacks
- Online guessing: trying passwords on the real login page. Sites limit attempts, lock accounts or add delays, so an attacker may get only a handful of guesses per hour. Even weak-ish passwords survive, unless they are among the most common ones.
- Offline cracking: after a data breach, attackers have the stored password hashes and can test guesses on their own hardware, with no limits. Speed then depends on how the site stored the passwords. A fast, outdated hash allows billions of guesses per second; a slow, modern one allows far fewer.
Worked examples
Assuming truly random characters and an offline attacker making ten billion guesses per second against a fast hash:
| Password | Worst case |
|---|---|
| 8 random lowercase letters | about 21 seconds |
| 8 random characters, all types | about 7 days |
| 16 random lowercase letters | about 138,000 years |
| 12 random characters, all types | about 1.5 million years |
Length beats complexity: sixteen lowercase letters outlast eight characters with symbols by a huge margin. On average an attacker finds a password in half the worst-case time.
Why your real password is weaker than the maths
Those figures apply only to random passwords. Human passwords follow patterns: a word, a capital at the start, a number and a symbol at the end, such as Summer2026!. Cracking software tries dictionary words, names, dates, keyboard runs like qwerty and common substitutions like @ for a first. A password that would take centuries by brute force can fall in seconds if it matches a pattern.
Check yours safely
- Open the Password Strength Checker. It runs in your browser and never sends the password anywhere.
- Type a password. It estimates the guesses needed using pattern recognition, not just length, and shows how an attacker would break it into parts.
- Read the times for four scenarios: online with and without rate limiting, and a stolen database with a slow or fast hash.
Even with a private tool, it is good practice to test a password similar to yours rather than your actual one.
What actually protects you
- A unique password for every site. Reused passwords are the main way accounts are taken over: one breach unlocks the others.
- Random passwords or passphrases from the Password Generator, stored in a password manager.
- Two-step verification on email, banking and anything important, so a stolen password alone is not enough.
For creating passwords you can remember, see how to create a strong password.