Password security guide
How Long Does It Take to Crack a Password?
There is no universal crack time. The answer depends on how the password was chosen, whether the attacker is online or offline, and how the service stores passwords.
Online guessing
An attacker submits guesses to the real service. Rate limits, delays, bot detection, lockout policy and MFA can sharply limit attempts. Recovery and phishing may become easier routes than continued guessing.
Offline guessing after hash theft
If an attacker obtains password hashes, guesses can be tested without the login service. Speed depends on the hashing algorithm, salt, work factor, memory cost, implementation and available hardware. Fast legacy hashes and modern memory-hard password hashing are not comparable.
Random search-space calculation
For a uniform pool of size N and length L, the space is N^L. An exhaustive search finds a uniformly random target halfway through on average. Divide half the space by an assumed guesses-per-second rate to model time.
Why human passwords are guessed earlier
Attackers try common passwords, leaked values, words, dates, keyboard paths and transformations first. A character-pool calculation assumes choices a person did not actually make. Pattern-aware models are better but remain estimates.
Credential stuffing needs no cracking
A reused leaked credential can be submitted directly. This is why uniqueness and MFA often provide more practical protection than adding a symbol to a reused base.
How to read calculator results
Record the pool, length, requirement rules, average versus worst-case search, guess rate and attack model. Treat very large durations as conditional mathematics, not a safety certificate.
Improve real resistance
Use unique generated values, add length, store them safely and enable modern authentication. Service operators should rate-limit, detect abuse and use a current salted password-hashing scheme with reviewed parameters.
Hash algorithms change offline cost
Password hashing is designed to make each guess expensive. Modern schemes use configurable time and often memory cost, with a unique salt per password. General-purpose fast hashes are unsuitable for password storage because attackers can test enormous numbers of guesses cheaply.
Published offline rates are meaningful only when the algorithm, parameters and hardware are stated. A rate for one hash format should not be applied to another.
Parallelism and attacker economics
Attackers can divide candidate guesses across hardware, but cost, power, memory and the value of the target constrain the effort. Common human choices are cheap to test because they appear early. A sufficiently long uniform random password pushes the target outside practical budgets under the stated model.
Why breach response should not wait for a crack estimate
If password hashes were exposed, users should follow the service guidance and replace reused or high-risk credentials promptly. You do not know the attacker hardware, dictionaries or whether the same password was obtained elsewhere. MFA and session review matter immediately.
Questions a crack-time chart should answer
- Was the password uniformly generated or human-selected?
- What pool and length were assumed?
- Is the attack online or offline?
- Which hash and cost parameters apply?
- Is the number average or worst-case time?
- Does the estimate include prioritized dictionaries?
If those details are missing, treat the chart as illustration rather than evidence.