How Long Would It Take to Crack Your Password?
By Lucian — builder & engineer, LK Forge
The strength of a randomly generated password is one number — its entropy, in bits — and it comes from a single line of arithmetic. We computed it across every length and character-set choice using the exact character sets our password generator ships, then turned each into a crack time. The results make one thing very clear: eight characters is no longer enough, and length matters far more than sprinkling in symbols.
Strength is one number: entropy
When a password is generated randomly, its unpredictability is exactly length × log₂(pool size), where the pool is how many characters could sit at each position. Turn on all four types — lowercase, uppercase, digits and symbols — and the generator draws from an 88-character pool (26 of them symbols). Each extra bit of entropy doubles the number of guesses an attacker must make, so this one number decides everything.
Key finding: an 8-character password with every character type has just 51.7 bits and falls to an offline attack in about 30 minutes. Add four characters — a 12-character password, 77.5 bits — and it would take roughly 3,400 years. A 16-character one (103.4 bits) is 2.0×10¹¹ years.
Crack time, by length
Entropy becomes a time once you assume a guessing rate. Below, every password uses all four character types. Offline assumes a GPU rig managing ~1 trillion guesses a second against a fast or unsalted hash — the worst realistic case if a site's password database leaks. Online assumes a well-behaved login that rate-limits to ~1,000 tries a second. Times are for the average attack, which searches half the space.
| Length | Entropy | Rating | Offline (10¹²/s) | Online (10³/s) |
|---|---|---|---|---|
| 6 | 38.8 bits | Weak | instant | 7 years |
| 8 | 51.7 bits | Fair | 30 minutes | 5.7×10⁴ years |
| 10 | 64.6 bits | Strong | 5 months | 4.4×10⁸ years |
| 12 | 77.5 bits | Strong | 3.4×10³ years | 3.4×10¹² years |
| 14 | 90.4 bits | Very strong | 2.6×10⁷ years | 2.6×10¹⁶ years |
| 16 | 103.4 bits | Very strong | 2.0×10¹¹ years | 2.0×10²⁰ years |
| 20 | 129.2 bits | Very strong | 1.2×10¹⁹ years | 1.2×10²⁸ years |
| 24 | 155 bits | Very strong | 7.4×10²⁶ years | 7.4×10³⁵ years |
The cliff is between 8 and 12. An 8-character password is a coffee break; a 12-character one is thousands of years; by 16 the numbers stop meaning anything human. That is the whole case for a password manager: you never type these, so there is no reason not to make them 20 characters of noise.
Length beats complexity
The instinct to reach for ! and $ is right, but weaker than the instinct to
add characters. Turning on symbols multiplies the pool once. Adding a character multiplies the
difficulty again at every position. The proof is blunt: a
11-character lowercase-only password already has more entropy
(75.2 bits at 16 chars) than an 8-character password using all four types
(51.7 bits). So if you have to choose, choose length — then add the other types on top, because
there is no reason not to.
One caveat that the arithmetic depends on: this all assumes the password is randomly generated. A human-chosen "P@ssw0rd!" has nowhere near the entropy its length and character variety suggest, because attackers guess predictable substitutions first. The formula is only honest for passwords a machine picked at random — which is exactly what a generator is for.
Push length a little further and the gap becomes absurd: a 16-character lowercase-only password holds 75.2 bits — well past 60-bit "strong", from an alphabet of just 26 letters, and comfortably beyond any 8- or 10-character password no matter how many symbols it uses. Complexity is a nice bonus; length is the lever.
Reproduce this
Every number comes from scripts/gen-password-entropy-study.mjs, using the generator's own
character sets. The core is two lines:
// entropy of a random password (pool = 88 with all four types)
const entropy = (length, pool) => length * Math.log2(pool)
// average crack time in seconds at a given guesses/second rate
const crackSeconds = (bits, rate) => 2 ** (bits - 1) / rate
// 8 chars, all types: entropy(8, 88) = 51.7 bits
// -> crackSeconds(51.7, 1e12) ≈ 30 minutesPool sizes come straight from the four character-set strings the generator ships (26 + 26 + 10 + 26 = 88). Nothing else is needed.
Generate one
Use the password generator — it shows the live entropy and strength rating as you change the length and character types, using exactly the formula above. Set it to 16 or more with all four types and let it make the noise for you; everything runs in your browser, and nothing is sent anywhere.
More generators
- UUID Generator — random v4 IDs with 122 bits of entropy, the reason collisions never happen in practice.
- Hash Generator — the one-way functions that turn a password into what a site actually stores.
- All the generators — passwords, UUIDs, hashes, QR codes and more, all in the browser.