Password Security: How Long Do Passwords Take to Crack, and What Actually Makes One Strong

A password is only as strong as the effort needed to guess it. Attackers rarely sit and type guesses. They use software that tries billions of combinations a second against stolen data, and they start with the passwords people actually use. This guide shows how long different passwords last against that kind of attack, and what to do about it.

How passwords get cracked

• Credential stuffing: attackers take email and password pairs leaked from one site and try them on others. If you reuse a password, one breach exposes all your accounts.
• Dictionary and pattern attacks: lists of common passwords, words, names, dates and keyboard patterns, plus common tricks like "P@ssw0rd" and a number at the end.
• Brute force: trying every combination, which is fast only when the attacker has the stored hash and can test offline.
• Phishing: tricking you into typing it into a fake site. No password length helps here, which is why a second factor matters.

Estimated cracking time

The table assumes an offline attack on a weakly protected, fast hash at 10 billion guesses per second, and on average the attacker finds the password halfway through the search. Sites that use slow, modern hashing make this far harder, and sites with login limits make online guessing very slow. Treat the figures as a comparison of relative strength, not a promise.

Two things stand out. First, length matters more than complexity: adding four characters multiplies the time by tens of thousands, much more than switching a few letters to symbols. Second, random words are easy to remember and still strong when chosen randomly. The catch is the word "random". A phrase like a song lyric or a quote is far weaker than the maths here suggests, because attackers try famous phrases. You can test your own with the password strength checker, which runs in your browser, and build strong ones with the password generator.

What makes a password weak, whatever its length

• Names, birthdays, phone numbers, vehicle numbers and cricket or film references.
• Keyboard walks such as "qwerty" or "1qaz2wsx".
• A base word with predictable changes, such as "Summer2026!" followed by "Summer2027!".
• The same password, or a small variation of it, on more than one account.

The rules that work

1. Use a unique password for every account. This one habit limits the damage of any breach.
2. Use a password manager. It generates and stores long random passwords, and fills them only on the real site, which also helps against phishing. Protect it with a long master passphrase and two-factor authentication.
3. Make master and email passwords the strongest. Your email can reset every other account, so it is the key to everything.
4. Turn on two-factor authentication, preferably with an authenticator app, a hardware key or a passkey, not SMS where there is a choice. A stolen password then is not enough.
5. Prefer passkeys where a site supports them. They replace the password with a cryptographic key that cannot be phished or reused.
6. Check for breaches of your email on a trusted breach-notification service and change affected passwords.

Myths to drop

• "Change passwords every month." Forced rotation leads to weaker, predictable passwords. Change when there is a reason, such as a breach.
• "Symbols make it secure." They help a little but add less than length.
• "Writing it down is always bad." A written password at home is safer than a reused one online, though a manager is better.
• "I have nothing worth stealing." Accounts are used to scam your contacts, take over social media and reset other services.

How sites should store passwords

A well-run service never stores your password. It stores a salted hash made with a slow function, so that even if the database leaks, each guess is expensive. If a site can email you your old password, it is storing it unsafely, so avoid reusing that one anywhere. You can see what a hash looks like with the hash generator, though tools like that are for learning and checks, not for protecting passwords on their own.

If you think an account is compromised

1. Change the password from a clean device and sign out all sessions.
2. Change the same password anywhere else you used it.
3. Enable two-factor authentication and review recovery email and phone numbers.
4. Check for forwarding rules and unfamiliar logins.
5. For financial accounts, call the bank at the number on the card and report on the cybercrime portal.

Frequently asked questions

How long should a password be?

At least 12 characters for ordinary accounts, 16 or more for important ones, or four to six random words.

Is a passphrase better than a complex password?

A random passphrase of several words is easier to remember and about as strong as a shorter complex password, provided the words are truly random.

Do I need a password manager?

Yes, if you have many accounts. It makes unique, long passwords practical.

Is SMS two-factor authentication enough?

It is better than nothing, but an authenticator app or passkey is safer.

Should I change my passwords regularly?

Only after a breach or suspected compromise, not on a fixed schedule.

How do I know if my password was leaked?

Use a reputable breach-notification service for your email, and change any reused passwords.

Last reviewed 8 November 2026. Rates, limits and rules change, so confirm figures with the official source before you act.