How Long Does It Take to Hack a Password? I Tested It

Short answer: a short password falls in seconds, a long one effectively never does. On October 31, 2026, I brute-forced a password I created myself on this Linux VM: a random 5-character lowercase password fell in 8.2 seconds. At the speed my machine actually measured — about 1 million guesses per second — an 8-character lowercase password would take about a day on average, while a 12-character password mixing upper, lower, digits and symbols would take billions of years. Length is the single biggest factor, and this article shows the real numbers behind that claim.

What I actually tested (and what I didn't)

Every password in this test was mine, created for this article, and hashed on my own machine. I did not touch anyone else's account, password, or data. The test machine is a Linux VM with 4 CPU cores and no GPU — an ordinary setup, not a cracking rig.

The scenario I tested is the worst case that still happens in the real world: a leaked database of fast, unsalted hashes (MD5). When a site stores passwords properly, with a slow hash like bcrypt, the numbers change completely — and I measured that difference too, below.

I used two tools, both run locally:

• A Python script using hashlib to measure MD5 speed and to brute-force my own test password character by character.
• zxcvbn, Dropbox's open-source password-strength estimator, to score common passwords and estimate their crack times.

The brute-force test: 8.2 seconds

First I measured the raw speed. My script computed MD5 hashes in a loop for 3 seconds and reached 1,077,664 hashes per second on a single core. Then I set the target: the MD5 hash of qkzmx, a random 5-character lowercase password I generated for the test. The script tried every combination from 1 to 5 lowercase characters in order. It found the password after 7,979,866 guesses in 8.2 seconds — about 976,000 guesses per second in the brute-force loop, matching the benchmark.

That is the whole point in one number: a 5-character password has only about 11.9 million possible combinations, and at a million guesses a second, the search space is exhausted in roughly 12 seconds at most. Mine happened to fall in 8.2.

How long would other passwords last?

Using the measured rate of about 1 million guesses per second, and assuming the attacker needs to search half the space on average, here is what the maths says for the fast-hash scenario:

Two things jump out. First, every extra character multiplies the search space — going from 8 lowercase letters to 8 mixed characters jumps the time from a day to years. Second, these numbers assume a single ordinary CPU core. A real attacker with a GPU farm or a botnet is far faster, which is why "a day" for 8 lowercase letters should really be read as "don't rely on it."

What zxcvbn says about passwords people actually use

Brute-force maths assumes random passwords, but people don't pick random passwords. They pick words, names, and patterns — and attackers know that, so they try dictionary words first. zxcvbn models this: it checks for common passwords, dictionary words, keyboard patterns, and dates, and estimates guesses accordingly. I ran six familiar-style passwords through it:

The "slow hash" column is zxcvbn's estimate against a deliberately slow hash at 10,000 guesses per second — the good-storage scenario, not the MD5 one. Even there, Summer2024! — a capital letter, a season, a year, and an exclamation mark, exactly the pattern password rules used to encourage — lasts only 46 minutes. Predictable patterns are not saved by adding a ! at the end.

By contrast, the two genuinely strong examples I tested scored 4 out of 4: correct horse battery staple (four random words) and the random 12-character aB3$xQ9!zL2. Both were rated at months to centuries depending on the attack scenario. Randomness, not complexity rules, is what makes a password strong.

The twist: good storage changes everything

So far every number assumed a fast hash. I also measured the other end of the scale: bcrypt, the slow hash that well-built sites use. One bcrypt hash at cost 12 took 0.457 seconds on this same machine — about 2.2 hashes per second, versus roughly 1 million MD5 hashes per second. That is roughly 500,000 times slower per guess.

That is why a password breach is not automatically a disaster: if the site stored passwords with bcrypt (or Argon2), even a mediocre password buys real time, and a strong one is effectively safe. What matters most is whether your password was unique to that site — a leaked password only endangers your other accounts if you reused it.

So what should you actually do?

Use a password manager and let it generate long, random passwords. A generated 16-plus-character password is unguessable in every scenario in this article, and you only have to remember one master password.

Make your master password a passphrase. Four or five random words, like the correct horse battery staple example, are both strong and memorable. Don't use a quote, a lyric, or words in a meaningful order — random is the point.

Turn on two-factor authentication everywhere it matters. A stolen password alone gets an attacker nowhere if login also needs your phone or security key.

Check whether your passwords have leaked. Have I Been Pwned lets you check an email address or password against known breaches without handing your actual password to a stranger — its password check uses a k-anonymity design, so only a fragment of the hash leaves your device. If a password of yours appears in a breach, change it everywhere you used it.

Never reuse a password across important accounts. Length protects one account; uniqueness protects all the others when one site fails you.

FAQ

How long does it take to hack an 8-character password? It depends entirely on the password and the storage. A random 8-character lowercase password falls in about a day against a leaked fast hash at the speed I measured; a random 8-character mixed password takes years in the same scenario. A predictable 8-character password like dragon12 can fall in seconds because attackers try dictionary words first.

Is a longer password always better? Almost always, yes — each extra random character multiplies the search space. But a long predictable password (iloveyouforever123) is weaker than a shorter random one, because attackers try patterns, not just random strings.

Does changing my password every 90 days help? For a strong, unique password, forced rotation mostly pushes people toward weaker, predictable variations. Changing a password matters when it has leaked or been reused — not on a calendar schedule.

Can a hacker crack my password from the login page? Not realistically. Login pages rate-limit and lock out repeated guesses. The fast numbers in this article apply to offline attacks, where an attacker already has a leaked password database and can guess without limit.

Conclusion

My test password fell in 8.2 seconds because it was short. The maths is unforgiving at the short end and generous at the long end: 5 characters is seconds, 8 mixed characters is years, 12 mixed characters is effectively forever — and proper slow hashing multiplies every one of those times by roughly 500,000. You don't need to memorise the numbers. You need a password manager, a random passphrase for the vault, two-factor authentication on important accounts, and no reused passwords.

How this article was made

This article was drafted with AI assistance (Tiny, UnlockProof's AI assistant) and reviewed against the site's evidence rules. The cracking test was run by hand on October 31, 2026, on a 4-core Linux VM with no GPU: a Python hashlib script measured 1,077,664 MD5 hashes per second, brute-forced my own test password qkzmx in 8.2 seconds after 7,979,866 guesses, and measured one bcrypt cost-12 hash at 0.457 seconds. Strength scores and the "slow hash" estimates come from zxcvbn, run locally on the same machine. The table of estimated crack times is arithmetic from the measured MD5 rate, not a claim about any real attack. No other person's password or account was involved at any point.