The answer to "how long would it take to crack my password?" depends on the password's length, the characters it uses and, above all, how the website stored it. In the 2026 edition of the Hive Systems password table, a random 8-character password with letters, numbers and symbols takes about 132 years to brute-force when it is stored with bcrypt. If the same password sits in an old MD5 database, one high-end graphics card tries every combination in under an hour. If your password was leaked before, is reused or is built from common words, its length barely matters, because it can fall in seconds.
Password crack time by length and character set
The table below shows how long a brute-force attack needs to try every possible combination. We computed it with a short script, using the attack speed that Hive Systems measured for its 2026 password table (published July 14, 2026). Every number rests on the same assumptions:
- The attacker already has the password hash from a stolen database and guesses offline, so there are no lockouts.
- The password was stored with bcrypt at work factor 10, a slow hashing method that Hive found common in real breaches.
- The hardware is two rented 8× RTX 5090 cloud servers, which Hive measured at 138,675 guesses per second.
- The password was randomly generated and has never appeared in a breach. The symbol column uses Hive's eight symbols (^*%$!&@#).
| Length | Numbers only (10) | Lowercase (26) | Upper + lowercase (52) | Letters + numbers (62) | Letters, numbers, symbols (70) |
|---|---|---|---|---|---|
| 6 | 7 seconds | 37 minutes | 1.7 days | 4.7 days | 9.8 days |
| 8 | 12 minutes | 17 days | 12 years | 50 years | 132 years |
| 10 | 20 hours | 32 years | 33,000 years | 192,000 years | 645,000 years |
| 12 | 83 days | 21,800 years | 89 million years | 737 million years | 3.2 billion years |
| 14 | 23 years | 14.7 million years | 242 billion years | 2.8 trillion years | 15.5 trillion years |
| 16 | 2,300 years | 10 billion years | 653 trillion years | 10.9 quadrillion years | 75.9 quadrillion years |
The numbers in parentheses are the character pool sizes. Each cell is the worst case for the attacker. On average, a random password is found after half of that time.
Our 8-character result for the full character mix matches the 132 years Hive reports for the same password class, which is a useful check on the method. Treat the table as a best case for you, though. It only describes random passwords protected by a slow hash, and Hive itself lists these limits in its methodology.
The math behind a brute-force estimate
A brute-force attack tries every possible password until one matches. The total number of candidates follows one formula:
combinations = (size of the character pool) ^ (password length)
Dividing that total by the attacker's guesses per second gives the maximum time:
time = combinations ÷ guesses per second
Here is the 8-character example from the table, worked through. The pool is 26 lowercase + 26 uppercase + 10 numbers + 8 symbols = 70 characters. That gives 70^8 = 576,480,100,000,000 combinations, or about 576 trillion. Dividing by 138,675 guesses per second gives about 4.16 billion seconds. Dividing that by the 31,557,600 seconds in a year gives about 132 years.
You can check the first step with the NumerSpace password combination calculator, which counts the combinations for any length and character mix. Note that the calculator counts 32 symbols instead of Hive's 8, so its totals are larger when symbols are switched on.
The formula also explains why length matters more than one extra character type. Adding symbols to an 8-character password raises the pool from 62 to 70 and multiplies the search by about 2.6. Adding four more characters instead multiplies it by the whole pool four times. That is why 12 random lowercase letters (21,800 years) outlast 8 characters with the full mix (132 years) in the table above.
How the hash algorithm changes the answer
Websites should never store your password itself. They store a hash, a one-way scrambled version of it, and check each login attempt against that hash. The hashing method decides how fast an attacker can test guesses once the database is stolen.
MD5 is a fast, general-purpose hash that many older systems used for passwords. A hashcat benchmark of the RTX 5090 (published February 10, 2025) shows one card computing 220.6 billion MD5 hashes per second. Bcrypt is built to be slow on purpose, and its work factor makes it slower still. At work factor 10, Hive's 16-GPU fleet manages 138,675 guesses per second. That makes MD5 roughly 1.6 million times faster to attack on one card than bcrypt on sixteen.
This comparison uses three guess rates for the same password classes. The middle column is the fixed rate of 1 billion guesses per second that the NumerSpace calculator assumes, so it matches what the calculator shows for these classes.
| Password | MD5, 1× RTX 5090 (220.6 billion/s) | Calculator default (1 billion/s) | bcrypt cost 10, 16× RTX 5090 (138,675/s) |
|---|---|---|---|
| 8 numbers | under 1 second | under 1 second | 12 minutes |
| 8 letters + numbers | 16 minutes | 2.5 days | 50 years |
| 12 lowercase letters | 5 days | 3 years | 21,800 years |
| 12 letters + numbers | 463 years | 102,000 years | 737 million years |
| 16 lowercase letters | 6,300 years | 1.4 million years | 10 billion years |
The same password can be safe for millennia or gone in minutes depending on a choice you never see. Because you cannot know how every site stores passwords, it is safer to assume the fast case and choose length accordingly.
Why the numbers shrink every year
Attacker hardware is the other half of the equation. Hive has published its table since 2020 and has moved from one RTX 2080 against MD5 in the first edition to today's rented RTX 5090 fleet against bcrypt. Holding the password and the hash constant, its 8-character full-mix result fell from 225 years (2024, recalculated at work factor 10) to 164 years in 2025 and 132 years in 2026. Hive estimates that crack times are falling by roughly a fifth to a quarter each year, so a password crack time quoted without its edition year is hard to compare with anything.
Online vs offline attacks
An online attack means guessing through the real login page. Here the website controls the pace. The current NIST guidelines, SP 800-63B-4 (final, July 2025), require verifiers to limit consecutive failed attempts on one account to no more than 100. At that cap, even a 6-digit PIN with a million combinations gives a random-guessing attacker a 0.01% chance before the login is disabled.
An offline attack starts after a data breach, when the attacker copies the stored hashes to their own machines. Lockouts, rate limits and alert e-mails no longer apply, which is why Hive's table and the calculations above assume this scenario. NIST makes the same point: resisting offline attacks requires passwords that are orders of magnitude stronger than those that only need to survive online guessing.
When length stops mattering: leaked, reused and dictionary passwords
Attackers do not start with random strings. They start with passwords from earlier breaches, dictionary words and common patterns, and only fall back to brute force when those fail. Hive timed this approach for its 2026 edition on a single rented RTX 5090. With predictable guesses tried first, a bcrypt-protected password fell in about three seconds, and a standard breach-list attack (the rockyou.txt list with hashcat rules) cracked the password "password" in about the same time.
Real-world data points the same way. Kaspersky's 2026 password study (May 7, 2026) tested 231 million unique passwords leaked between 2023 and 2026 against MD5 on one RTX 5090. It found that 48% fell in under a minute and 60% in under an hour. The study also found that 54% of the passwords had already surfaced in earlier leaks.
This is why NIST requires services to compare new passwords against a blocklist of commonly used, expected or compromised values. You can run a similar check yourself with Have I Been Pwned's Pwned Passwords, which hashes the password on your device and sends only the first five characters of its SHA-1 hash. Avoid typing a real password into an unknown "strength checker" site.
How to estimate how long to crack a password you use
To work out roughly how long to crack a password you actually use, follow the same logic as the tables above:
- Ask whether it is random. If you made it up from words, names, dates or keyboard patterns, or reuse it anywhere, assume the leaked-password case: seconds to minutes.
- Find the character pool: 10 for numbers, 26 for lowercase, 52 for both cases, 62 with numbers, and more with symbols.
- Raise the pool to the power of the length, or let the password combination calculator do it.
- Divide by a guess rate that fits the threat. Use 138,675 per second for bcrypt on Hive's 2026 fleet, and 220.6 billion per second for MD5 on one RTX 5090.
- Halve the result for the average case, and remember that next year's hardware will be faster.
What length holds up?
NIST SP 800-63B-4 sets a minimum of 15 characters for passwords used on their own and 8 characters only when the password is part of multi-factor authentication. It also tells services not to force mixtures of character types, because people respond with predictable patterns such as "Password1!". Practical advice on building and remembering passwords that long, from passphrases to password managers, is in our guide to creating a secure password combination.
By the math above, 15 random lowercase letters would take about 383 million years against Hive's bcrypt fleet and about 241 years against MD5 on one RTX 5090. Neither figure protects you if the same password is reused on another site and leaks there.