Eight random characters. That's all that stands between a stolen database and your account, and a single modern GPU rig chews through it in under two hours. Stretch it to sixteen random characters and the same rig grinds for longer than the universe has existed. So the 2026 answer comes down to two things: how long the password is, and how the site stored it, because a fast hash like plain SHA-256 and a slow one like bcrypt move the timeline by years. We've run the real math with current GPU numbers below, plus why your clever 'Summer2026!' is weaker than a shorter random string, and the two habits that keep an account safe whatever happens to the database.
The short answer
A truly random 8 character password survives about 1.8 hours against a modern offline cracking rig. Twelve random characters buys you 17,000 years. At 16 you’ve left physics behind. Length is the lever; everything else is decoration.
The math behind the answer
Password cracking is a counting problem. Draw from a pool of 95 printable characters and you get 95^n possibilities at length n; an attacker needs half of them on average. The only other variable is guessing speed.
And we don’t have to guess at the speed. Public hashcat benchmarks put a single RTX 4090 at roughly 164 billion MD5 guesses per second. Six of them, a rig any motivated criminal or red team can assemble for the price of a used car, gets you to a round trillion. That’s the assumption behind every number in this article: offline attack, fast hash, 10^12 guesses per second.
Run the arithmetic and the cliff appears. 95^8 is about 6.6 quadrillion, which melts in 1.8 hours. 95^10 holds for roughly 1.9 years. 95^12 stretches to 17,000 years, and 95^16 to 1.4 trillion years. Each pair of characters buys you a factor of about 9,000.
Time to crack a random password, offline at 10^12 guesses/sec
Log scale. Full set = 95 printable characters. Assumes a fast hash (MD5/NTLM); slow hashes like bcrypt multiply every figure by 100,000 or more.
Offline versus online: the distinction that changes everything
Those terrifying speeds need one condition: the attacker must hold the hashes. That happens after a database breach, when a dump of hashed passwords lands on their disk and they can guess at hardware speed with nobody watching.
Against a live login form, the picture flips. Rate limiting and lockouts cap attackers at maybe 10,000 guesses per second across a botnet, and honestly that’s generous for a poorly defended target. The same 8 character password that dies in 1.8 hours offline would take two centuries online.
Which is why breach notifications matter more than password paranoia. The moment a service you use gets breached, the offline clock starts on your hash. If that password was unique to the breached site, you’ve lost one account. Reuse it and you’ve lost every account that shares it; attackers automate exactly that with credential stuffing. Verizon’s Data Breach Investigations Report has put stolen credentials at or near the top of breach vectors for years running.
Fast hashes, slow hashes, and why your sysadmin choices matter
Everything above assumes the defender stored passwords with a fast hash. MD5 and SHA-1 were built to be quick. So was plain SHA-256. That’s exactly the problem: a hash designed for speed hands that speed to the attacker.
Password hashing algorithms are slow on purpose. bcrypt at a sane cost factor drops a GPU to tens of thousands of guesses per second instead of hundreds of billions. That one design decision multiplies every crack time in the chart by 100,000 or more. The 1.8 hour password becomes a 20 year password; the 12 character one outlives the solar system. Argon2id, the current OWASP recommendation, also eats GPU memory bandwidth, which hurts cracking rigs where it stings.
If you run systems, your storage choice is part of every user’s password strength whether they know it or not. NTLM in a 2026 Active Directory is a gift to whoever exfiltrates your hashes.
Why “Summer2026!” dies in seconds anyway
Here’s the honest caveat: the chart describes random passwords, and humans don’t produce random. Real cracking doesn’t open with brute force. It opens with wordlists built from a decade of breaches, then mutation rules: capitalize the first letter, bolt a year on the end, swap a for @, try the obvious symbol. The pattern word + year + symbol that satisfies most corporate complexity policies falls in the first minutes of any competent run.
So “Summer2026!” is eleven characters of false comfort. Its effective entropy isn’t 95^11. It’s one dictionary word with a predictable suffix, a search space a laptop clears before lunch. Complexity rules produced this, and forced 90 day rotation made it worse by training people to increment a counter. NIST SP 800-63B retired both practices. It took the industry years to listen.
Randomness is what makes the math apply. A generator gives it to you for free.
What to actually do
For accounts: a password manager generating 20+ random characters per site, unique everywhere. You’ll never type them, so length costs nothing. (I don’t know my own passwords anymore, and that’s the point.) Our password generator runs entirely in your browser and shows you the honest entropy of what it produces, against these exact attack assumptions.
For the few secrets you type by hand (the manager’s master password, your OS login): a passphrase of 6 or 7 random words. At 10 bits per word you reach 60 to 70 bits, which survives offline attack against any sanely-stored hash. Your thumbs will thank you.
And for everything important, turn on multi-factor authentication. A cracked password without the second factor is a key to a door that no longer exists.
Where passkeys fit into this
The industry’s actual answer to cracking is to remove the password. Passkeys, the consumer-friendly name for FIDO2/WebAuthn credentials, swap the shared secret for a key pair: your device holds the private key, the site stores only the public half. There’s nothing to crack offline, because the server-side database contains nothing that opens your account. Nothing to phish either, since the credential is bound to the real domain. Google, Apple, Microsoft, GitHub and most major password managers support them today, and adoption has moved from press releases to login screens.
So should you still care about password length? Yes, twice over. Coverage first: thousands of services you use will accept passwords and nothing else for years to come, and your NAS or that industrial web interface from 2014 isn’t getting a WebAuthn retrofit. Then the recovery chain: most passkey deployments keep a password as the fallback path, which makes the fallback the weakest link. A passkey protected by a recoverable account with a 9 character password is a 9 character account.
Our practical 2026 posture: passkeys wherever they’re offered, a manager full of long random passwords everywhere else, a serious passphrase guarding the manager itself, and MFA on the accounts that can hurt you. None of these pieces replaces the others yet. Together they make the crack-time chart above someone else’s problem.
One last number to keep. The gap between 8 and 16 characters isn’t twice the security. It’s a factor of about 6.6 quadrillion. Nothing else you can do this afternoon buys that much.
Frequently asked questions
Is a 12 character password enough in 2026?
Yes, with room to spare, as long as it's actually random with the full character set: around 17,000 years against a trillion-guess-per-second offline attack. The catch is that word, random. A 12 character password built from a word plus a year plus a symbol isn't random, and rule-based attacks chew through it in minutes.
Do symbols make a password stronger than length?
Length wins, and it isn't close. Symbols grow the character pool from 62 to about 95, a factor of 1.5 per character. One extra character multiplies the search space by 95. Four extra lowercase letters beat any amount of symbol decoration on a short password.
How fast can attackers really guess passwords?
Offline, against a stolen database of fast hashes like MD5 or NTLM, a single RTX 4090 tests around 164 billion MD5 guesses per second per hashcat benchmarks, so a small rig reaches trillions. Online, a live login form with rate limiting caps attackers at tens of guesses per second at best. That's why stolen hash databases are the real danger.
Does changing my password every 90 days help?
No, and official guidance agrees. NIST SP 800-63B dropped forced rotation years ago because it trains people into predictable patterns like Password2026!. Change a password when there's a real reason, a breach or a suspicious login. Otherwise leave it alone: make it long and unique, and let a manager remember it.
