How long to crack your password
Every website demands an uppercase, a number and a symbol — and that demand created a generation of passwords that are hard for humans and easy for computers. The maths behind it is simple, and it points the opposite way from what most people do.
1. The password every site asks for
Your password is 8 characters long and uses uppercase, lowercase, digits and symbols — exactly what the forms demand. An attacker with the leaked database and a graphics card tries 100 billion combinations per second. How long does it take?
2. Build your own password
Move the length and the character types. The number of combinations is alphabet size raised to the length — every extra character multiplies the difficulty, while widening the alphabet only raises the base.
3. Length beats complexity
Here is what almost nobody knows. Compare two passwords that look worlds apart in quality:
The "hard" 8-character password loses badly to 12 plain lowercase letters. And there is a bonus: the second one is far easier to type and remember. That is why modern guidance favours passphrases — four to six random words deliver far more security than any 8-character symbol soup.
Password strength is only half the story — and often not the deciding half. A unique password per service matters more than a complex one: when one site leaks, a reused password opens all your other accounts (this is credential stuffing, and it works alarmingly well). Add two-factor authentication, which stops an attacker even with the right password, and a password manager, which solves the problem of remembering dozens of long, distinct passwords. Rotating passwords on a schedule with no reason is no longer recommended: it pushes people into predictable variations.
Generate a strong password now
Configurable length, character types, and generation entirely in your own browser.
Open the Password Generator →See also: Combinations & permutations · Lesson: the birthday paradox
Teaching estimates. Real time depends on the hashing algorithm the service uses, the attacker's hardware, and whether the password appears in breach lists — a long password already leaked falls instantly, no matter how many combinations it has on paper.