Password Crack Time Calculator

How long would it take a hacker to crack your password? Find out instantly.

901 yearsTime to crack (offline)
StrongStrength
72.3Entropybits
Length
11 characters
Character set size
95
Average guesses needed
2,844,000,461.4T
Seconds (raw)
28,440,004,613.82295

Good: length and variety make this password expensive to brute-force. Remember never to reuse it across sites.

Time to crack under each attack scenario
ScenarioGuesses per secondTime
Online attack, rate-limited (100 guesses/s)100901.2 billion years
Online attack, no throttling (10,000/s)10K9 billion years
Offline, slow hash like bcrypt (100,000/s)100K901.2 million years
Offline, fast hash like MD5, one GPU rig (100 billion/s)100B901 years
Offline, nation-state scale (100 trillion/s)100T10 months 3 weeks

About the Password Crack Time Calculator

How long would it take to crack your password? This tool estimates the answer for realistic attack scenarios, from a website that limits login attempts to an offline cracking rig running billions of guesses per second against a leaked database. The estimate is based on entropy: the number of characters multiplied by the log₂ of the character set (lowercase, uppercase, digits, symbols), reduced for obvious patterns such as common passwords, repeated characters, keyboard sequences and years.

The maths: an attacker needs on average half of all possible combinations, so time = (charsetlength ÷ 2) ÷ guesses per second. Adding one character multiplies the work by the charset size, which is why length matters far more than swapping an "a" for "@".

Everything is computed in your browser with no network requests, so it is safe to test real passwords, though testing a variant is even safer. Use a password manager to generate long, unique passwords for every account and turn on two-factor authentication wherever it is offered.

How to use the Password Crack Time Calculator

  1. Type a password (or a similar one) into the box. It is never sent to a server.
  2. Choose the attack scenario that worries you: an online login attack or an offline attack on a stolen database.
  3. Read the estimated crack time, the entropy in bits and the strength rating, and compare all scenarios in the table.

Frequently asked questions

Is it safe to type my real password here?

The analysis runs entirely in your browser and no data is transmitted. Even so, the safest habit is to test a similar password rather than the exact one you use.

How long should a password be?

At least 12 characters for everyday accounts and 16 or more for email, banking and password-manager master passwords. A random 16-character password with mixed characters has over 100 bits of entropy and is beyond brute force.

Why is a passphrase of four words strong?

If each word is picked randomly from a list of 7,776 words (as in Diceware), four words give about 52 bits and five words 65 bits, comparable to a 10-12 character random password, while being far easier to remember.

Why does the result say "instantly" for a long password?

Because it is a known common password. Attackers try the top few million leaked passwords before any brute force, so "iloveyou2020" is cracked in seconds regardless of its length.