Guide · 2 min read
How long it really takes to crack a password
Those "your password would take X years" charts are often misleading. How password crackers actually work, and what makes a password hold up or fall in seconds.
Last updated:
The colourful charts that circulate online, “8 characters with symbols: 5 hours”, say something true but incomplete. They assume the attacker tries every possible combination, one by one. Attackers almost never do.
How attacks actually work
When a site is breached, attackers usually do not get your password but its fingerprint (a hash). With it, they can test guesses on their own machines, with no limit on attempts and without anyone noticing. The order in which they guess decides everything:
- Passwords that have already leaked. There are lists of hundreds of millions of real passwords. “123456”, “password” or “Liverpool1992” fall in the first second.
- Words and names with variations. Dictionaries in many languages, first names, teams, dates, and the usual substitutions: “a” for “@”, “o” for “0”, a capital at the start and a number at the end.
- Keyboard patterns and sequences. “qwerty”, “asdfgh”, “1qaz2wsx”.
- Brute force, only at the end, for whatever has not fallen yet.
The speed depends on the site, not on you
How many guesses per second an attacker can make depends on how the site stored the fingerprints:
- With fast, outdated algorithms, a single modern graphics card tries tens of billions per second.
- With slow algorithms designed for passwords, such as bcrypt or Argon2, the same card drops to thousands or tens of thousands per second.
You do not know how each site stores your password, so the prudent assumption is the bad case.
What makes a password hold up
- Resembling nothing. What protects most is not appearing on any list and not following any pattern.
- Length. Every unpredictable character multiplies the work.
- Being unique. If you reuse a password and it leaks from one site, attackers try it on every other.
A phrase of several words chosen at random, like the ones the auditor generates, is long, easy to remember and on no list.
Check yours
Audit passwords estimates how long a password would take to fall in three realistic scenarios, accounting for dictionary words in English and Spanish, names, dates and keyboard patterns. The password is analysed in your browser and sent nowhere. Even so, if you would rather not type yours, try a variant in the same style: the result will be just as useful.