How long does it take to crack a password?

Every password advice page tells you to mix upper case, digits and symbols. Very few tell you why, or how much each step actually buys. The answer is a short piece of arithmetic, and once you have seen it the right choice becomes obvious: length and randomness matter far more than clever substitutions.

This article does the arithmetic with real numbers. The times below are what it takes to try every possible password of a given kind, at speeds that public benchmarks report for current hardware.

How passwords are actually attacked

There are two very different situations. In an online attack, someone types guesses into a login form. Sites slow this down, lock accounts and ask for second factors, so an attacker gets perhaps a few guesses a minute. Almost any password that is not on a list of common ones survives that.

The dangerous case is an offline attack. When a site is breached, the attacker takes a copy of the password database home. Passwords should be stored as hashes, one-way fingerprints that cannot be reversed, so the attacker hashes guesses on their own hardware and compares. There are no locks and no rate limits, only the speed of their graphics cards.

That speed depends enormously on the hash the site used. In published benchmarks, a single current high-end graphics card tests well over 100 billion guesses a second against a fast hash such as MD5 or NTLM, but fewer than 200,000 a second against bcrypt, which is deliberately slow. You cannot see which one a site uses, so it is wise to plan for the fast case.

Entropy: counting the possibilities

The useful measure of a password is entropy, written in bits. It is the base 2 logarithm of the number of passwords that could have come out of the method you used. Each extra bit doubles the number of guesses an attacker needs.

For a password made of random characters, the count is easy: the number of possible characters raised to the power of the length. Lower case letters give 26 choices per character, so 8 of them give 26 to the power of 8, about 209 billion possibilities, or 37.6 bits. Using all 94 printable characters on a keyboard (upper and lower case, digits and 32 symbols) gives 6.1 quadrillion possibilities for the same 8 characters, or 52.4 bits.

For a passphrase made of random words, count words instead of characters. The EFF long word list that our password generator uses has 7,776 words, so each word adds about 12.9 bits. Four words give 51.7 bits, six words give 77.5 bits.

The numbers

Here is the time needed to try every possible password of each kind with one graphics card. On average an attacker finds a given password in half that time.

Two things stand out. First, length wins over variety: 12 lowercase letters (56.4 bits) beat 8 characters of every type (52.4 bits), and they are much easier to type on a phone. Second, the jump from "breakable in a day" to "breakable in a lifetime of the universe" happens over just a few extra characters or two extra words, because the numbers grow exponentially.

Why your own password is weaker than the table says

The table assumes the password was chosen at random. Passwords that people invent are not. Cracking tools start with lists of billions of leaked passwords, then apply rules that mimic how people build them: a word, a capital first letter, a year, an exclamation mark at the end, letters swapped for look-alike digits.

A password such as Summer2024! has 11 characters of four types, which looks like 72 bits. In practice it is a season, a year and a symbol, and a rules-based attack tries it within the first few billion guesses, which takes well under a second against a fast hash. P@ssw0rd123 is in every list. Length made of predictable parts adds very little.

This is also why the strength meters on sign-up forms can mislead. A meter that counts character types gives Summer2024! full marks and rates quietly-orbit-lantern-pebble-fossil no higher, although the second is far stronger.

What makes a good password today

• Let a computer choose it. Random characters or random words, from a password manager or a generator that uses your browser's cryptographic random source.
• Go for at least 12 characters, or 16 if you never type it. A password manager fills it in, so length costs nothing.
• Use a passphrase where you must type it. Five or six random words are long but easy to type and remember, which suits a laptop login or the password manager itself.
• Never reuse a password. Most account takeovers today do not crack anything: they try passwords leaked from one site on another.
• Turn on a second factor for email, banking and anything that can reset other accounts. It makes a stolen password useless on its own.

Symbols are still worth including when a site allows them, because they raise the number of choices per character. They are simply not a substitute for length, and they are worthless when they appear where everyone puts them.

How the generator on this site works

The password generator on Tooloat draws every character or word from crypto.getRandomValues, the browser's cryptographic random number generator, and it runs entirely on your device: nothing you generate is sent anywhere. It shows the entropy of the method you chose and three cracking estimates, from an online attack to a large cluster, so you can see the effect of each setting before you copy the result.

For most accounts, the default of 20 random characters is the right answer. For the one password you type every day, choose Passphrase and five or six words.