How Long Does It Take to Crack a Password in 2026?
See how long it takes to crack 8, 12, 16, and 20-character passwords in 2026 across RTX 5090 GPUs, MD5, SHA-256, bcrypt, and Argon2id hashes.
Quick Answer: In 2026, an 8-character lowercase password can be cracked in under 2 seconds by an offline GPU cluster testing 100 billion guesses per second, while an 8-character mixed-case alphanumeric password falls in 36 minutes. By contrast, a truly random 16-character password using all four character types (94-character ASCII pool, 104.9 bits of entropy) takes over 12 trillion years to brute-force.
Understanding how long it takes to crack a password requires looking at three mathematical factors: total character length ($L$), character pool size ($N$), and the hashing algorithm used to store the password. You can generate a brute-force-resistant 16 to 24 character credential instantly using our free browser-only Password Generator or test an existing password pattern locally with our Password Strength Checker.
2026 Password Crack-Time Reference Table (8 to 24 Characters)
The table below compares real-world offline cracking times across fast legacy hashes (unsalted MD5/NTLM at 180 billion guesses/sec and SHA-256 at 25 billion guesses/sec on multi-GPU RTX 4090 / RTX 5090 rigs) versus modern slow key-derivation functions (bcrypt cost 12 at 120,000 guesses/sec and Argon2id at 25,000 guesses/sec):
| Password Length & Pool | Entropy ($H$) | Fast Hash: MD5 / NTLM (180B/s) | Fast Hash: SHA-256 (25B/s) | Slow KDF: bcrypt c=12 (120K/s) | Memory-Hard: Argon2id (25K/s) | 2026 Security Verdict |
|---|---|---|---|---|---|---|
| 8 chars (lowercase only, $N=26$) | 37.6 bits | ~1.1 seconds | ~8.3 seconds | ~19 days | ~92 days | Unsafe — Compromised Instantly |
| 8 chars (all 4 sets, $N=94$) | 52.4 bits | ~9.4 hours | ~2.8 days | ~804 years | ~3,860 years | Weak — Fails Against Fast Hashes |
| 10 chars (alphanumeric, $N=62$) | 59.5 bits | ~54 days | ~1.1 years | ~111,000 years | ~530,000 years | Fair — Low-Risk Accounts Only |
| 12 chars (all 4 sets, $N=94$) | 78.6 bits | ~83 million yrs | ~600 million yrs | ~1.2 × 1014 yrs | ~6.0 × 1014 yrs | Good — PCI DSS 4.0 Minimum |
| 16 chars (all 4 sets, $N=94$) | 104.9 bits | ~6.8 × 1012 yrs | ~4.9 × 1013 yrs | > 1019 yrs | > 1020 yrs | Strong (NIST / CCCS / ENISA Standard) |
| 20 chars (all 4 sets, $N=94$) | 131.1 bits | > 1020 yrs | > 1021 yrs | > 1027 yrs | > 1028 yrs | Very Strong (128-Bit Class) |
| 24 chars (all 4 sets, $N=94$) | 157.3 bits | > 1028 yrs | > 1029 yrs | > 1034 yrs | > 1035 yrs | Maximum (Master Vaults & Admin) |
How Attackers Actually Crack Passwords in 2026
Attackers rarely guess passwords by typing them into a website login form, where rate-limiting and multi-factor authentication (MFA) block automated bots after 5 to 10 failed attempts. Instead, password cracking happens offline after a database breach exposes password hashes. Using tools like Hashcat and John the Ripper on consumer and cloud GPU clusters (such as NVIDIA RTX 4090, RTX 5090, and H100 nodes), attackers execute four primary attacks:
- Dictionary & Leaked-Corpus Attacks: Testing billions of real passwords leaked in prior breaches (RockYou2024, Collection #1–5) in seconds. Any reused password fails immediately regardless of its length.
- Rule-Based Mutation Attacks: Applying predictable human transformations (such as capitalizing the first letter, replacing
awith@orewith3, and appending2026!) to dictionary words. - Mask & Hybrid Attacks: Targeting known structural patterns, such as an 8-character password that starts with an uppercase letter followed by 5 lowercase letters and 2 digits (
?u?l?l?l?l?l?d?d). - Pure Exhaustive Brute-Force: Testing every mathematically possible combination in the keyspace ($N^L$). This is the only attack that works against a genuinely random string created with
window.crypto.getRandomValues().
The Mathematics of Crack Time: Why Length Beats Complexity
Cryptographic keyspace entropy ($H$) is measured in bits using Shannon's formula: H = L × log2(N), where $L$ is the password length and $N$ is the size of the character pool. Each additional bit of entropy doubles the number of guesses an attacker must perform.
When you use all four character sets (26 uppercase + 26 lowercase + 10 digits + 32 symbols = 94 characters), every single character adds 6.555 bits of entropy ($\log_2(94) \approx 6.555$) and multiplies the total keyspace by 94:
- Moving from 8 to 12 characters increases keyspace by $94^4$ (78,074,896 times harder to crack).
- Moving from 12 to 16 characters increases keyspace by another $94^4$ (6.09 quadrillion times harder than an 8-character password).
- If you prefer memorable words over dense symbols, a 5-word passphrase from our Passphrase Generator with capitalization and a number delivers ~74.6 bits of entropy, while a 6-word passphrase delivers ~87.5 bits.
Official Length Standards Across the USA, Canada, UK & Europe
Because modern GPUs can brute-force 8-character passwords against fast hashes in hours, cybersecurity agencies across North America and Europe now recommend longer baselines:
- United States (NIST SP 800-63B & CISA): Recommends 15–16+ character random passwords or multi-word passphrases, mandatory screening against breached-password lists, and phishing-resistant MFA.
- Canada (Canadian Centre for Cyber Security — CCCS): Advises at least 12-character random passwords or 4-word passphrases (15+ characters total) stored in a password manager.
- United Kingdom (UK NCSC) & Europe (ENISA): Recommends "Three Random Words" or 16+ character generated passwords paired with two-step verification (2SV).
Frequently Asked Questions
Can an 8-character password still be safe in 2026?
No. Even if an 8-character password uses uppercase letters, lowercase letters, numbers, and symbols (52.4 bits of entropy), an offline GPU cluster can brute-force it against fast hashes like MD5 or NTLM in under 10 hours, and human-chosen 8-character passwords fall in seconds to rule-based dictionary attacks.
How long does it take to crack a 12-character vs. 16-character password?
A truly random 12-character password using all 4 character types (78.6 bits of entropy) takes roughly 83 million years to crack at 180 billion guesses per second, making it the minimum acceptable baseline for PCI DSS 4.0. A 16-character random password (104.9 bits of entropy) takes over 6.8 trillion years even against fast hashes.
Does adding an exclamation mark at the end make a password much harder to crack?
Not if the base word is predictable. Cracking tools like Hashcat automatically test common suffixes such as !, 123, and the current year on the first pass. True crack resistance comes from full cryptographic randomness across all character positions.
We focus on practical, privacy-first password guidance and update articles when recommendations change.