What do the calculations show?
Under the 1 billion guesses-per-second example, checking every 12-character password made from letters and numbers takes 102,234.22 years. For 16 printable ASCII characters, the same calculation gives 1.18 quadrillion years.
Scope: every figure assumes a uniformly random password and a constant guessing speed. Real results depend on how a password was chosen, stored, and attacked.
How do the estimates change by length and character set?
This table fixes the speed at 1,000,000,000 guesses per second. It shows the average number of guesses and the time needed to check every possibility; the CSV includes all three assumed speeds.
| Length | Character set | Possible passwords | Bits | Average search | Check every password |
|---|---|---|---|---|---|
| 8 | Lowercase letters (26) | 208,827,064,576 | 37.60 | 1.74 minutes | 3.48 minutes |
| 12 | Lowercase letters (26) | 95,428,956,661,682,176 | 56.41 | 1.51 years | 3.02 years |
| 16 | Lowercase letters (26) | 43,608,742,899,428,874,059,776 | 75.21 | 690,938.84 years | 1.38e6 years |
| 20 | Lowercase letters (26) | 19,928,148,895,209,409,152,340,197,376 | 94.01 | 3.16e11 years | 6.31e11 years |
| 24 | Lowercase letters (26) | 9,106,685,769,537,214,956,799,814,036,094,976 | 112.81 | 1.44e17 years | 2.89e17 years |
| 8 | Uppercase, lowercase, and digits (62) | 218,340,105,584,896 | 47.63 | 1.26 days | 2.53 days |
| 12 | Uppercase, lowercase, and digits (62) | 3,226,266,762,397,899,821,056 | 71.45 | 51,117.11 years | 102,234.22 years |
| 16 | Uppercase, lowercase, and digits (62) | 47,672,401,706,823,533,450,263,330,816 | 95.27 | 7.55e11 years | 1.51e12 years |
| 20 | Uppercase, lowercase, and digits (62) | 704,423,425,546,998,022,968,330,264,616,370,176 | 119.08 | 1.12e19 years | 2.23e19 years |
| 24 | Uppercase, lowercase, and digits (62) | 10,408,797,222,153,426,578,715,765,348,940,396,820,955,136 | 142.90 | 1.65e26 years | 3.30e26 years |
| 8 | Printable ASCII characters (94) | 6,095,689,385,410,816 | 52.44 | 35.28 days | 70.55 days |
| 12 | Printable ASCII characters (94) | 475,920,314,814,253,376,475,136 | 78.66 | 7.54e6 years | 1.51e7 years |
| 16 | Printable ASCII characters (94) | 37,157,429,083,410,091,685,945,089,785,856 | 104.87 | 5.89e14 years | 1.18e15 years |
| 20 | Printable ASCII characters (94) | 2,901,062,411,314,618,233,730,627,546,741,369,470,976 | 131.09 | 4.60e22 years | 9.19e22 years |
| 24 | Printable ASCII characters (94) | 226,500,146,052,898,041,878,222,437,726,567,560,344,026,218,496 | 157.31 | 3.59e30 years | 7.18e30 years |
Which guessing speeds did we compare?
We used three fixed speeds so the effect of changing the rate is easy to see. They are examples, not hardware benchmarks.
- Rate-limited model: 100 guesses/second. Mathematical input illustrating an online service with throttling; not a measured service rate.
- Offline 1 billion/s model: 1,000,000,000 guesses/second. Mathematical offline-search input; not a claim about named hardware or a particular password hash.
- Offline 1 trillion/s model: 1,000,000,000,000 guesses/second. Aggressive mathematical offline-search input; not a claim about named hardware or a particular password hash.
How did we calculate these figures?
We keep combination totals as exact whole numbers. When a report includes time estimates, we keep them as exact fractions of a second and use 31,557,600 seconds per year for the readable versions. Entropy estimates use log2(number of possible outcomes) and assume every choice is random and equally likely. Expected trials are (N + 1) / 2 for a uniformly selected target in an undiscounted enumeration; exhaustive trials are N.
These are mathematical comparisons, not measurements from real attacks or specific hardware.
Where did the information come from?
- NIST SP 800-63B-4, Appendix A: Strength of Passwords — explains the difference between generated and user-chosen passwords, along with the different limits on online and offline guessing.
- NIST SP 800-63B-4, Section 3.2.2: Rate Limiting — explains why online guessing is usually slowed or blocked.
- Release 1 data and calculation details — every alphabet, length, guessing speed, formula, and result used on this page.
We calculated every number in these tables from the inputs listed above. None of the figures were copied from NIST.
The three guessing speeds are examples we chose to make the scenarios easy to compare. They are not benchmarks for current hardware, cracking software, or a particular password-hashing method.
NIST source: NIST Special Publication 800-63B-4: Authentication and Authenticator Management, published 2025-08-26; reviewed 2026-10-21.
Can you download or cite this data?
Yes. The JSON contains the full release, and the CSV is ready for a spreadsheet or chart.
Suggested citation: “Generate My Password, Password Guessing Time Estimates, release password-statistics-release-1-v1 (2026-10-21).”
Related statistics
See what 100 popular services publish about password requirements, compare random password length and search space, review random passphrase combinations, or generate a random password locally.