How Long Would It Take to Crack Your Password?

Crack time comes down to entropy — the number of possible combinations, measured in bits, where every additional bit doubles the guesses an attacker needs. A password with around 40 bits of entropy requires over a trillion guesses; one with 60 bits requires over a quintillion. The gap between "crackable in minutes" and "crackable in millions of years" is a handful of extra characters, not a special symbol.

What the numbers actually look like

• ~16 bits of entropy — cracked in about a minute at 1,000 guesses/second
• ~40 bits of entropy — over a trillion guesses required
• ~60 bits of entropy — the recommended minimum for everyday accounts
• ~80 bits of entropy — recommended for email, banking, or any account that can reset other accounts
• ~128 bits of entropy — appropriate for a password manager's master password

A weak, common password like "P@ssw0rd!" — despite technically containing every character type — can be cracked in about two days on modern hardware, because attackers' cracking tools are built around exactly these predictable substitutions (@ for a, 0 for o). Entropy measures unpredictability, not variety, which is why a random password beats a patterned one at the same length.

Why length dominates the calculation

Each additional character in your password multiplies the total possible combinations by roughly the size of your character set (26 for lowercase, 62 for mixed-case-plus-digits, and so on). Each additional character type only multiplies by that same small factor once, no matter how long the password already is — so a 20-character lowercase-only password ends up harder to brute-force than an 8-character password using every character type available.

Attack speed only gets faster

Crack-time estimates assume a specific guessing speed, and that speed climbs every year as hardware improves — a password that would have taken centuries to crack a decade ago might be feasible in years today. That's the real argument for generous length margins rather than cutting it close to whatever the "minimum acceptable" entropy happens to be this year.