How long would it take to crack your password?
No question explains better why length beats everything else. Let's look at real brute-force numbers with modern cracking hardware (multi-GPU rigs testing hundreds of billions of combinations per second against fast hashes).
The scary table
Approximate time to crack a random password using lowercase+uppercase+numbers+symbols:
| Length | Combinations | Estimated time |
|---|---|---|
| 8 characters | ~6 × 10¹⁵ | Hours |
| 10 characters | ~5 × 10¹⁹ | Months |
| 12 characters | ~5 × 10²³ | Thousands of years |
| 14 characters | ~4 × 10²⁷ | Millions of years |
| 16 characters | ~4 × 10³¹ | Billions of years |
Careful: these times only hold for genuinely random passwords. "Barcelona2026!" has 14 characters and would fall in seconds, because attackers do not try random combinations — they try words, names and patterns from a dictionary first.
How attacks actually work
- Dictionary: millions of words, names, dates and passwords leaked from other sites, with automatic variations (initial capital, number at the end, @ for a…). It breaks most "human" passwords in minutes.
- Credential stuffing: your email and password leaked from one site are tried on hundreds of others. That is why reuse is so serious.
- Pure brute force: only viable against short passwords. From 12-14 random characters up, it is mathematically hopeless.
What this means in practice
- With 16 random characters, brute force is off the table for any attacker, nation-states included.
- Randomness takes you out of the dictionary attack — the one that breaks 90% of real passwords.
- Uniqueness (one per service) protects you from credential stuffing, the most common attack of all.
All three together — long, random, unique — make your password an unprofitable target. And you get all three in two clicks with a generator and a manager.
💡 Try it yourself: use our Strong password generator — free, no sign-up, no watermarks.
Frequently asked questions
Won't these times shrink as computers get faster?
Yes, but that growth is linear against an exponential problem: doubling the attacker's speed is offset by a single extra character. That is why 16 characters will remain infeasible for decades.
What about quantum computers?
Known quantum algorithms (Grover's) would halve the effective bits: a 16-character password would still be impractical. Quantum risk matters more for communications encryption than for hashed passwords.
How can a site check my password without knowing it?
Serious sites store a hash (an irreversible mathematical fingerprint), not the password. At login they hash what you type and compare. Breaches expose hashes that attackers try to crack — the longer your password, the more useless the hash is to them.
Does swapping a letter for a symbol (a→@) help?
Barely: cracking tools apply those substitutions automatically. Adding two more characters gives vastly more security than any "clever" substitution.