Password Crack Time Calculator
Estimate brute-force crack time from password length, character set, and attacker speed.
Returns the average time, from milliseconds to billions of years.
Password crack time depends on the password’s length, character set, and the attacker’s computing power. Modern GPU-based attacks can test billions of passwords per second.
Character set sizes:
- Numbers only (0–9): 10 characters
- Lowercase letters (a–z): 26 characters
- Lowercase + uppercase (a–z, A–Z): 52 characters
- Letters + numbers: 62 characters
- Letters + numbers + symbols: 95 characters
The formula: Total combinations = Character Set Size ^ Password Length Time to crack = Total Combinations ÷ Guesses per Second ÷ 2
That final division by two is the part most crack-time tables leave out. Exhausting every combination is the worst case. On average an attacker finds the password halfway through, so the expected time is half the keyspace. This calculator reports the average, which is what the row labelled “Time to crack (average)” means.
Attack speeds:
- Online attack against a live login form, rate-limited: 1,000 guesses/second
- Offline attack on a stolen hash, single GPU: 10 billion guesses/second
- Offline attack on a stolen hash, GPU cluster: 1 trillion guesses/second
The gap between the first row and the other two is the whole reason password reuse matters. An attacker who has to talk to a login form is throttled to a crawl. An attacker who has stolen the password database is not talking to anything, and gets the other two numbers.
Examples at 10 billion guesses/second. Type these in and you will get the same figures back:
| Password | Combinations | Average crack time |
|---|---|---|
| “password” (8 lowercase) | 26^8 = 209 billion | 10.4 seconds |
| “Password1” (9, letters + digits) | 62^9 = 13.5 quadrillion | 7.8 days |
| “P@ssw0rd!” (9, all types) | 95^9 = 630 quadrillion | 364.7 days |
| Random 12, letters + digits | 62^12 = 3.2 × 10^21 | 5.1 thousand years |
| Random 16, letters + digits | 62^16 = 4.8 × 10^28 | longer than the age of the universe |
That last row works out at about 76 billion years, roughly five and a half times the 13.8 billion years the universe has existed. Past that point the calculator stops printing a figure, because a number nobody can put in context is not an answer.
Every figure in that table assumes the password is genuinely random, and only the bottom two rows are. “Password1” sits in every cracking wordlist ever assembled and falls in milliseconds rather than 7.8 days. “P@ssw0rd!” is barely better, because leetspeak substitution on a common word is the first transformation any cracking tool applies. Brute force is the attack of last resort, so treat these as a ceiling rather than a forecast.
Key insight: Length matters more than complexity. A 16-character lowercase password (26^16 = 4.4 × 10^22) is stronger than an 8-character password with all character types (95^8 = 6.6 × 10^15).
Best practices:
- Use a passphrase of 4+ random words (e.g., “correct horse battery staple”)
- Minimum 12 characters for any account
- Use a password manager to generate and store unique passwords
- Enable two-factor authentication (2FA) for critical accounts
- Never reuse passwords across sites
Note: This calculator assumes brute force attack. Dictionary attacks, credential stuffing, and social engineering can be much faster if the password is common or reused.
How we build and check this calculator
This calculator runs entirely in your browser, so the numbers you enter stay on your device. The math behind it is written by hand and tested against worked examples and standard references before the page goes live.
SuperGlobalCalculator is independently built and maintained. See how we build and verify our calculators.