Original research · T.O. Mercer · June 2026

How long does it take to crack a password in 2026?

We ran the numbers on current hardware. The honest answer swings from instant to longer than the universe has existed, and it turns on two things almost nobody thinks about: how the website stored your password, and whether you invented it yourself.

Stored with

Check a password shape

Pick a length and character set. This is the time to try every possible combination of that shape, assuming a truly random password. An attacker finds it in about half that time on average.

Length

Character set

Time to brute-force

—

The 2026 crack-time table

Every cell is the time to brute-force a random password of that length and character set. Flip the hashing toggle above and watch the whole table change colour. Same passwords, two ways the site could have stored them.

Time to brute-force a random password

SafePasswordGenerator.net · T.O. Mercer · June 2026

The table only protects a random password

If you made your password up, none of these numbers apply to you.

The grid assumes every character is random. Real passwords almost never are. They are built from words, names, dates, and predictable swaps like P@ssw0rd!. Pattern-based and machine-learning cracking, from PassGAN to its 2026 successors, targets exactly that structure. A human-chosen password usually falls in a tiny fraction of the time its length and character set suggest, no matter how complex it looks. Test your password habits with our pattern checker to see whether your style is closer to random or predictable. The only way to actually earn the green end of this table is to let software generate the password for you.

Generate a random password

Methodology

Everything here is reproducible. If you want to argue with a number, argue with these assumptions, not a black box.

🧮

The formula

Combinations equal the character-set size raised to the password length. Time is combinations divided by guesses per second.

# worst case, every combination
time = size ^length / rate

⚡

Fast-hash rate

~1 trillion guesses/second. Roughly an eight-GPU consumer rig (RTX 5090-class) attacking an unsalted MD5 or SHA-1 hash, the kind still found in real breach dumps.

🐢

Slow-hash rate

~50,000 guesses/second. The same rig against bcrypt at cost factor 10. bcrypt is deliberately slow, which is the entire point of using it.

⚠️

What this is not

It is a brute-force ceiling for a random password. It does not model dictionary, rule-based, or machine-learning attacks, which crack human-made passwords far faster.

Cite this

Suggested citation

T.O. Mercer, “How long does it take to crack a password in 2026?” SafePasswordGenerator.net, June 2026.