TamingShare home

How long does it take to crack a password?

Paul Ogier. Last checked 17 September 2026.

How long it takes to crack a password depends on three things: whether it has already leaked, whether it was chosen at random, and how the site stored it. A leaked password takes no time at all, because nobody has to crack it. A random 12-character password stored with bcrypt takes about 10.7 billion years on one graphics card.

Get the first one wrong and the other two stop mattering.

Infographic. Have I Been Pwned counts on 17 September 2026: 123456 seen 210,461,208 times, qwertyuiop 8,988,385, P@ssw0rd 6,421,042, Password1 3,461,492, Password1! 584,516, Facebook1985! 384, Amazon1985! 180. Time for one RTX 5090 to try every combination of a random password, stored as NTLM or with bcrypt cost 10: 8 lowercase letters, 0.61 seconds or 254 days; 8 characters of upper and lower case and numbers, 11 minutes or 726 years; 12 characters, 301 years or 10.7 billion years; 16 characters, 4.4 billion years or 159 quadrillion years.

The chart everyone shares answers a narrower question

There's a colourful chart of password crack times that goes round Reddit every few weeks and gets treated as gospel. It answers one narrow question: how long it takes to try every combination of a random password, on one set of hardware, against one way of storing it.

The chart leaves out whether the password has already leaked, whether a person chose it, and how the site stored it. This page is about those three.

In 2001 I watched a security speaker recommend a password that is now on the breach lists

In 2001 I was in the audience at a South African tech conference while a security speaker explained how to build a secure password that the average person could remember. Take a base word. Add the name of the site. Add your birth year. Finish with an exclamation mark.

The audience groaned while the speaker was still talking. It sounded clever on paper: one recipe to remember and a different password for every site. Twenty-five years later, the room turns out to have been right.

Have I Been Pwned already holds the 2001 recipe

Have I Been Pwned keeps a list of passwords that have turned up in data breaches, and anyone can look a password up against it. On 17 September 2026 it returned these counts[1]:

PasswordTimes seen in breaches
123456210,461,208
qwertyuiop8,988,385
P@ssw0rd6,421,042
Password13,461,492
Password1!584,516
Facebook1985!384
Amazon1985!180

Facebook1985! and Amazon1985! are the 2001 recipe with the base word left off. Between them they turned up 564 times, and both are on a list anyone can check.

123456 is not news. When the UK's National Cyber Security Centre analysed breach data in 2019, it found 23.2 million accounts using it[2].

P@ssw0rd and Password1! are what password rules produce. NIST's own guidance uses that exact example: a user who would have chosen "password" is "relatively likely to choose "Password1" if required to include an uppercase letter and a number or "Password1!" if a symbol is also required"[3].

A password on these lists has no crack time. NIST points out that attackers "are likely to guess passwords that have previously proven successful", including "passwords from previous breaches"[4]. The list gets tried first.

South Africans reuse passwords too, going by the one study I could find

The best South African numbers I found come from a 2018 study by Rika Butler and Martin Butler in the South African Journal of Information Management. It used an online survey of South African online consumers and analysed 737 valid responses[5]. That makes it a picture of the people who answered, not of the whole country, and it is eight years old.

Using the same password on several accounts at once was the most common bad habit, at 90.1%, and 77.3% reused passwords[6].

39 respondents (5.3%) believed they had absolute knowledge of proper password practice, and exactly one person (0.1%) could demonstrate flawless practice[7]. That is my favourite number in the whole study.

Personally meaningful words and numbers got more common the older the respondents were[8]. I was at that 2001 conference, so I am not in a position to point fingers.

I also went looking for a South African body that sets a minimum password length and couldn't find one. The rules further down this page come from the US, the UK and Canada.

How long cracking takes depends on how the site stored the password

This section assumes the bad day. Someone has stolen the site's password database and is guessing offline, with no lockout and no MFA in the way. Guessing at a login page is a far slower fight and a different article.

A site doesn't keep your password. It keeps a hash of it, and NIST says the attacker's chances depend "on how the password is stored"[9]. Fast hashes let an attacker make a huge number of guesses quickly, which is why OWASP says to protect passwords with slow hashing algorithms such as bcrypt[10].

Here are the two ends of the scale on one Nvidia RTX 5090 running hashcat's benchmark:

  • NTLM, a fast hash: 340.1 billion guesses a second[11].
  • bcrypt at 32 iterations, which is cost 5: 304.8 thousand guesses a second[12].

For sites still on bcrypt, OWASP says to use a work factor of 10 or more[13]. Cost 10 is 1,024 iterations, 32 times the work of cost 5, so I divided by 32 and got 9,525 guesses a second. That figure is my calculation, not a measurement.

If the password database is stolen and guessed offline, this is how long that one card takes to try every combination of a random password:

Random passwordStored as NTLMStored with bcrypt, cost 10
8 characters, lowercase letters only0.61 seconds254 days
8 characters, upper and lower case and numbers11 minutes726 years
12 characters, same mix301 years10.7 billion years
16 characters, same mix4.4 billion years159 quadrillion years

That's one card. Ten cards divide every time by ten. I wouldn't accept an 8-character minimum on any site that might be storing NTLM.

These times only apply to a random password. A password a person picked is predictable, and NIST notes that users respond "in very predictable ways" to composition rules[14]. Facebook1985! doesn't get a row in this table. It's on the list.

The rule-makers now ask for length, not symbols

NIST's current guidance, SP 800-63B revision 4, says:

  • Passwords used on their own "SHALL" be "a minimum of 15 characters in length"[15].
  • Verifiers "SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types)"[16].
  • They "SHALL NOT require subscribers to change passwords periodically"[17].
  • They "SHALL allow the use of password managers and autofill functionality"[18].
  • New passwords get checked against "a blocklist that contains known commonly used, expected, or compromised passwords"[19].

The UK's NCSC says to "Combine three random words to create a password that's 'long enough and strong enough'"[20]. The Canadian Centre for Cyber Security recommends "a minimum of 12 characters" for passwords[21], and a passphrase of "at least 4 words and 15 characters in length"[22].

NIST, the NCSC and the Canadian centre don't agree on the number. They all push you towards a longer password rather than a cleverer one.

Set the rule for everyone, not just yourself

Your own password is one account. The admin console is every account, and the defaults there still carry some of the old advice.

In Microsoft Entra ID, cloud accounts need "A minimum of 8 characters" and "three out of four of the following types of characters"[23], and Microsoft says that unless noted, "you can't change these settings"[24]. Tenants created before 2021 also default to a 90-day password expiry[25].

Entra's saving grace is Password Protection. Its global banned password list is applied to every user and "can't be disabled"[26]. You can add up to 1,000 terms of your own[27]. Microsoft's advice is to ban the base term "Contoso" rather than variants like "Contoso!1", and let the algorithm block "weak variants and combinations"[28].

Entra Password Protection isn't a wall, though. In Microsoft's own example "ContoS0Bl@nkf9!" is accepted, even with two banned terms inside it[29]. Put your company name, your town and your products on the custom list anyway.

In Google Workspace you can set a minimum length "between 8 and 100 characters"[30]. I'd set it to 15. Leave expiry off: Google turns it off by default "because research has shown little positive impact on security"[31].

What to do on Monday

  • Use a password manager and let it generate a long random password for every account. If you need one right now, the password generator or the passphrase generator makes one in your browser.
  • Change your email password first. Whoever gets into your email can "reset all your other account passwords"[32].
  • Turn on MFA everywhere it's offered, starting with email and admin accounts.
  • In the admin console, set the minimum length to 15 and fill in the custom banned list.
  • When a new starter or contractor needs a password, generate it, force a change at first sign-in, and send it once as a burn-after-reading link. The steps are in how to send a password to a contractor.

Then paste that password into tamingshare.com instead of an email, switch on Burn after reading, and send the link.

Sources checked

  1. for p in 123456 qwertyuiop 'P@ssw0rd' Password1 'Password1!' 'Facebook1985!' 'Amazon1985!'; do h=$(printf %s "$p" | shasum | cut -c1-40 | tr a-f A-F); curl -s "https://api.pwnedpasswords.com/range/${h:0:5}" | grep "${h:5}" | tr -d '\r' | sed "s/^/$p /"; done run on 17 September 2026.
  2. "Breach analysis finds 23.2 million victim accounts worldwide used 123456 as password" (read 16 September 2026) - Most hacked passwords revealed as UK cyber survey exposes gaps in online security
  3. "would be relatively likely to choose ... if required to include an uppercase letter and a number or ... if a symbol is also required" (Complexity) - NIST SP 800-63B-4, Authentication and Authenticator Management
  4. "attackers are likely to guess passwords that have previously proven successful. These include dictionary words and passwords from previous breaches" - NIST SP 800-63B-4, Authentication and Authenticator Management
  5. "A sample of 737 valid responses was analysed for this research." (read 16 September 2026) - Butler and Butler (2018), Some password users are more equal than others, SAJIM 20(1)
  6. "The most prevalent poor practices were the simultaneous use of the same passwords (90.1%) and password reuse (77.3%)." (read 16 September 2026) - Butler and Butler (2018), Some password users are more equal than others, SAJIM 20(1)
  7. "A total of 39 respondents (5.3%) perceived that they possessed absolute knowledge of proper password practices. However, only a single respondent (0.1%) was able to demonstrate flawless ability to apply proper password practices" (read 16 September 2026) - Butler and Butler (2018), Some password users are more equal than others, SAJIM 20(1)
  8. "the practices of using personally meaningful words and numbers, not changing passwords regularly and using unsafe storing practices increased, the older the respondents were" (read 16 September 2026) - Butler and Butler (2018), Some password users are more equal than others, SAJIM 20(1)
  9. "depends on how the password is stored" (Length) - NIST SP 800-63B-4, Authentication and Authenticator Management
  10. "they must be protected using strong, slow hashing algorithms such as Argon2id, bcrypt, or PBKDF2. ... Fast hashing algorithms such as SHA‑256 are not suitable for password storage because they allow attackers to perform large numbers of guesses quickly." (read 16 September 2026) - OWASP Password Storage Cheat Sheet
  11. "Hash-Mode 1000 (NTLM) ... 340.1 GH/s" (read 16 September 2026) - Hashcat v6.2.6-851 benchmark on the Nvidia GeForce RTX 5090 FE
  12. "Hash-Mode 3200 (bcrypt $2*$, Blowfish (Unix)) [Iterations: 32] ... 304.8 kH/s" (read 16 September 2026) - Hashcat v6.2.6-851 benchmark on the Nvidia GeForce RTX 5090 FE
  13. "For legacy systems using bcrypt, use a work factor of 10 or more" (read 16 September 2026) - OWASP Password Storage Cheat Sheet
  14. "research has shown that users respond in very predictable ways to the requirements imposed by composition rules" (Complexity) - NIST SP 800-63B-4, Authentication and Authenticator Management
  15. "Verifiers and CSPs SHALL require passwords that are used as a single-factor authentication mechanism to be a minimum of 15 characters in length." (Password Verifiers) - NIST SP 800-63B-4, Authentication and Authenticator Management
  16. "Verifiers and CSPs SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types) for passwords." (Password Verifiers) - NIST SP 800-63B-4, Authentication and Authenticator Management
  17. "Verifiers and CSPs SHALL NOT require subscribers to change passwords periodically." (Password Verifiers) - NIST SP 800-63B-4, Authentication and Authenticator Management
  18. "Verifiers SHALL allow the use of password managers and autofill functionality." (Password Verifiers) - NIST SP 800-63B-4, Authentication and Authenticator Management
  19. "verifiers SHALL compare the prospective secret against a blocklist that contains known commonly used, expected, or compromised passwords" (Password Verifiers) - NIST SP 800-63B-4, Authentication and Authenticator Management
  20. "Combine three random words to create a password that’s ‘long enough and strong enough’." (read 16 September 2026) - NCSC, Three random words
  21. "For passwords, we recommend that you use a minimum of 12 characters." (read 16 September 2026) - Canadian Centre for Cyber Security, Best practices for passphrases and passwords (ITSAP.30.032)
  22. "Your passphrase should be at least 4 words and 15 characters in length." (read 16 September 2026) - Canadian Centre for Cyber Security, Best practices for passphrases and passwords (ITSAP.30.032)
  23. "A minimum of 8 characters and a maximum of 256 characters. ... Requires three out of four of the following types of characters" (Microsoft Entra password policies, read 16 September 2026) - Self-service password reset policies - Microsoft Entra ID
  24. "Unless noted, you can't change these settings" (Microsoft Entra password policies, read 16 September 2026) - Self-service password reset policies - Microsoft Entra ID
  25. "If the tenant was created before 2021, it has a 90 day expiration value by default." (Microsoft Entra password policies, read 16 September 2026) - Self-service password reset policies - Microsoft Entra ID
  26. "There's nothing to enable or configure, and can't be disabled." (Global banned password list, read 16 September 2026) - Password protection in Microsoft Entra ID
  27. "The custom banned password list is limited to a maximum of 1,000 terms." (Custom banned password list, read 16 September 2026) - Password protection in Microsoft Entra ID
  28. "it would be wasteful and less secure to try to block specific variations of these terms ... The password validation algorithm then automatically blocks weak variants and combinations." (Custom banned password list, read 16 September 2026) - Password protection in Microsoft Entra ID
  29. "ContoS0Bl@nkf9! ... this password contains two banned passwords ... it's accepted." (Score Calculation, read 16 September 2026) - Password protection in Microsoft Entra ID
  30. "It can be between 8 and 100 characters." (Set password requirements, read 16 September 2026) - Enforce and monitor password requirements for users - Google Workspace Admin Help
  31. "Password expiration is turned off by default because research has shown little positive impact on security." (How password expiration works, read 16 September 2026) - Enforce and monitor password requirements for users - Google Workspace Admin Help
  32. "reset all your other account passwords (and get access to all your other online accounts)" (read 16 September 2026) - NCSC, Use a strong and separate password for email

What we could not source:

  • I could not find a South African body that sets a minimum password length. Checked on 16 September 2026: the financial sector's Joint Standard 2 of 2024 as published by the Prudential Authority, and POPIA section 19.

Sources last verified: 16 September 2026. Next review due: 16 December 2026.