How Long to Crack My Password? Real GPU Numbers (2026)

For a random password, crack time depends on three things: its length, the set of characters it draws from, and the hash the site used to store it. On a single RTX 4090, an 8-character password using every printable character falls in about 11 hours if the site stored it as unsalted MD5, and in about 36,000 years if it used bcrypt at cost 10. You rarely know which one a site uses, so pick a length that survives the bad case.

Every number below comes from hashcat 6.2.6 benchmarks on one RTX 4090 and assumes the attacker tries the full keyspace. The average crack finds the password halfway through, so halve any figure for the typical case. A rented 8-GPU rig divides them by 8 again.

Password crack time by length and charset

Unsalted SHA-256 sits between the two columns but much closer to MD5: about 22 billion guesses per second, so 8 printable characters last roughly 3.5 days instead of 11 hours, which is no real protection.

If you want the number for your own password, the Password Strength Checker runs the same entropy math locally in your browser; the password never leaves the page. Treat its result as an upper bound, for the reasons in the dictionary section below.

The hash matters more than the password

The ratio between the two columns is about 28 million to one. MD5 and SHA-256 were built to be fast. bcrypt, scrypt and Argon2id were built to be slow and tunable, and bcrypt's cost factor doubles the work with every step. At cost 5 an RTX 4090 manages 184,000 bcrypt hashes per second; at cost 10 it's 32 times slower. (A lot of articles, including an earlier version of this one, quote that 184,000 figure as if it were cost 10. It isn't.)

Argon2id is missing from the table on purpose. Its speed depends on how much memory and how many passes the site configures, so any single "guesses per second" number is meaningless without the parameters. What you can say is that each guess costs the attacker the configured memory (OWASP's floor is 19 MiB), which is exactly what makes GPU farms inefficient against it.

None of this is under your control. You don't know whether the forum you joined in 2014 used MD5, and if it was breached, its hash database is already sitting on someone's disk. I wrote about the storage side in more detail in bcrypt vs MD5.

Online vs offline attacks

The table only describes offline attacks: the attacker has the hash database and guesses on their own hardware with no limits.

Online attacks go through the real login form. Even a lenient service that allows 10 attempts per second would need about 660 years to exhaust 8 lowercase letters. That's why nobody brute-forces logins one account at a time. Online attackers spray the few hundred most common passwords across many accounts instead, which only works if yours is on that list.

Doing the math yourself

The number of combinations is R^L, where R is the size of the character pool and L is the length. In bits of entropy:

H = L × log₂(R)

• 12 characters from 95 printable ASCII: 12 × 6.57 ≈ 78.8 bits
• 15 characters from the same set: about 98.5 bits
• 6 random words from the EFF list of 7,776: 6 × log₂(7776) ≈ 77.5 bits

To turn that into time, divide the combinations (2^H) by the hash speed. 12 printable characters give 5.4 × 10²³ combinations; divided by 164.1 billion MD5 guesses per second, that's 3.3 × 10¹² seconds, or 104,000 years.

The pool size grows slowly and the exponent grows fast. Going from lowercase to all 95 characters multiplies an 8-character keyspace by about 31,000. Adding four lowercase characters to a 12-character lowercase password multiplies it by 26⁴, about 457,000. More on where the "12 vs 15 characters" line comes from in password entropy and minimum length.

Why your real password probably falls much faster

Everything above assumes the password is random. Human-chosen passwords aren't, and attackers don't brute-force them. They start with wordlists.

The 2024 "RockYou2024" compilation holds close to 10 billion strings, mostly recycled from older leaks. Against MD5, simply hashing every one of them takes a fraction of a second. Then come rule files that mutate each word thousands of ways: capitalize the first letter, swap a for @, append 1, !, or a year. Ten billion words times 50,000 rules is 5 × 10¹⁴ candidates, which is under an hour on one card at MD5 speed.

That's how these fall regardless of their length:

• P@ssw0rd2024!: a dictionary word with the most common substitutions and a year
• Summer2026!: season, year, symbol, which rule sets try early
• sarah1998 or Michael2001: name plus birth year
• qwertyuiop123: keyboard walks are in every list

The 2023 headlines about AI tools like PassGAN cracking "most passwords in a minute" were largely tested on passwords from the same RockYou leak the model was trained on. Machine learning does make guessing human-style passwords somewhat better. It does nothing against a password that came out of a random generator, because there's no pattern to learn.

The other real-world risk is reuse. Credential stuffing takes email and password pairs from one breach and tries them on other sites. There's no cracking involved at all, so length doesn't help. Only a unique password per site does.

How long your password should be

NIST SP 800-63B Rev. 4 (2025) sets 15 characters as the minimum when a password is the only authentication factor, and 8 when it's used with MFA. It also tells services to drop composition rules and forced rotation and to check new passwords against breach lists instead. That minimum is written for passwords people choose themselves. For a randomly generated one, 15 printable characters is about 98 bits, which is beyond any realistic offline attack.

What I'd use:

Generate the passwords rather than inventing them. People are bad at randomness in ways that rule files are built to exploit. The Password Generator draws every character from crypto.getRandomValues(), the browser's cryptographic RNG, not Math.random(), whose output can be predicted after a few samples.

FAQ

How long does it take to crack an 8-character password?

It depends on the characters and the storage. On one RTX 4090, trying every combination, 8 lowercase letters take about 1.3 seconds against MD5 and 8 characters from all 95 printable symbols take about 11 hours. Behind bcrypt at cost 10 that second password lasts roughly 36,000 years on the same card. Halve those numbers for the average case and divide by the number of GPUs the attacker rents.

Is a 12-character password strong enough in 2026?

A random 12-character password using all printable characters gives about 79 bits, which is around 104,000 years worst case against MD5 on one GPU. That's fine. A 12-character password you invented is a different story: if it follows a common pattern, it falls to a dictionary-plus-rules attack long before brute force matters. NIST now asks for 15 characters when the password is the only factor.

What is the difference between online and offline password cracking?

Online cracking means guessing through the real login form, limited by rate limits and lockouts to a few attempts per second. Offline cracking happens after a breach, against the stolen hash database, at whatever speed the attacker's hardware allows. Crack-time tables, including the one above, only describe the offline case.

Does password length or complexity matter more?

Length. Adding symbols to a lowercase password raises the base from 26 to 95, a one-time gain. Every extra character multiplies the whole keyspace by the base again. A 16-character lowercase password (about 4.4 × 10²² combinations) beats a 10-character password using all 95 printable characters (about 6 × 10¹⁹).