How long can password cracking take?
At 1 billion guesses per second, checking every 12-character password made from letters and numbers would take about 102,234.22 years. A 16-character password using printable ASCII expands that example to about 1.18 quadrillion years.
Important: these are comparison examples, not predictions for a real account or stolen password hash.
How long would each password take to guess?
The table uses 1,000,000,000 guesses per second. It shows both the average search time and the time needed to check every possible password; the CSV includes all three guessing speeds.
| Length | Character set | Possible passwords | Bits | Average search | Check every password |
|---|---|---|---|---|---|
| 8 | Lowercase letters (26) | 208,827,064,576 | 37.60 | 1.74 minutes | 3.48 minutes |
| 12 | Lowercase letters (26) | 95,428,956,661,682,176 | 56.41 | 1.51 years | 3.02 years |
| 16 | Lowercase letters (26) | 43,608,742,899,428,874,059,776 | 75.21 | 690,938.84 years | 1.38e6 years |
| 20 | Lowercase letters (26) | 19,928,148,895,209,409,152,340,197,376 | 94.01 | 3.16e11 years | 6.31e11 years |
| 24 | Lowercase letters (26) | 9,106,685,769,537,214,956,799,814,036,094,976 | 112.81 | 1.44e17 years | 2.89e17 years |
| 8 | Uppercase, lowercase, and digits (62) | 218,340,105,584,896 | 47.63 | 1.26 days | 2.53 days |
| 12 | Uppercase, lowercase, and digits (62) | 3,226,266,762,397,899,821,056 | 71.45 | 51,117.11 years | 102,234.22 years |
| 16 | Uppercase, lowercase, and digits (62) | 47,672,401,706,823,533,450,263,330,816 | 95.27 | 7.55e11 years | 1.51e12 years |
| 20 | Uppercase, lowercase, and digits (62) | 704,423,425,546,998,022,968,330,264,616,370,176 | 119.08 | 1.12e19 years | 2.23e19 years |
| 24 | Uppercase, lowercase, and digits (62) | 10,408,797,222,153,426,578,715,765,348,940,396,820,955,136 | 142.90 | 1.65e26 years | 3.30e26 years |
| 8 | Printable ASCII characters (94) | 6,095,689,385,410,816 | 52.44 | 35.28 days | 70.55 days |
| 12 | Printable ASCII characters (94) | 475,920,314,814,253,376,475,136 | 78.66 | 7.54e6 years | 1.51e7 years |
| 16 | Printable ASCII characters (94) | 37,157,429,083,410,091,685,945,089,785,856 | 104.87 | 5.89e14 years | 1.18e15 years |
| 20 | Printable ASCII characters (94) | 2,901,062,411,314,618,233,730,627,546,741,369,470,976 | 131.09 | 4.60e22 years | 9.19e22 years |
| 24 | Printable ASCII characters (94) | 226,500,146,052,898,041,878,222,437,726,567,560,344,026,218,496 | 157.31 | 3.59e30 years | 7.18e30 years |
Which guessing speeds did we compare?
We used three fixed speeds so the effect of changing the rate is easy to see. They are examples, not hardware benchmarks.
- Rate-limited model: 100 guesses/second. Mathematical input illustrating an online service with throttling; not a measured service rate.
- Offline 1 billion/s model: 1,000,000,000 guesses/second. Mathematical offline-search input; not a claim about named hardware or a particular password hash.
- Offline 1 trillion/s model: 1,000,000,000,000 guesses/second. Aggressive mathematical offline-search input; not a claim about named hardware or a particular password hash.
How did we calculate these figures?
We keep combination totals as exact whole numbers. When a report includes time estimates, we keep them as exact fractions of a second and use 31,557,600 seconds per year for the readable versions. Entropy estimates use length × log2(alphabet size) and assume every choice is random and equally likely. Expected trials are (N + 1) / 2 for a uniformly selected target in an undiscounted enumeration; exhaustive trials are N.
These are calculated examples, not tests of real attacks or specific hardware. The EFF word-length figures are different: they count every word in the published list.
Where did the information come from?
- NIST SP 800-63B-4, Appendix A: Strength of Passwords — explains the difference between generated and user-chosen passwords, along with the different limits on online and offline guessing.
- NIST SP 800-63B-4, Section 3.2.2: Rate Limiting — explains why online guessing is usually slowed or blocked.
- Release 1 data and calculation details — every alphabet, length, guessing speed, formula, and result used on this page.
We calculated every number in these tables from the inputs listed above. None of the figures were copied from NIST.
The three guessing speeds are examples we chose to make the scenarios easy to compare. They are not benchmarks for current hardware, cracking software, or a particular password-hashing method.
NIST source: NIST Special Publication 800-63B-4: Authentication and Authenticator Management, published 2025-08-26; reviewed 2026-10-21.
Can you download or cite this data?
Yes. The JSON contains the full release, and the CSV is ready for a spreadsheet or chart.
Suggested citation: “Generate My Password, Password Cracking Time Models, release password-statistics-release-1-v1 (2026-10-21).”
Related research
Compare length and alphabet size, review random passphrase models, or generate a random password locally.