100 password cells — how it is stored changes the answer more than length does
Bits of entropy and time-to-crack for every meeting of 10 character sets and 10 lengths. The speeds are not invented — they are published hashcat measurements on a single RTX 4090.
full ASCII with symbols 12 · 78.7 bit
- NTLM (Windows)26136.9 years
- MD545950.7 years
- SHA-256343132.2 years
- WPA2 Wi-Fi10^9.5 years
- bcrypt10^10.6 years
What one character carries
What one character carries is the logarithm of the alphabet size: 3.3 bits for digits only, 4.7 with lowercase letters, 6.6 for the 94 printable ASCII characters. Total strength is that times the length, which is why adding length usually beats adding variety — one more ASCII character buys 6.6 bits, while widening from lowercase to full ASCII buys only 1.9 bits per character.
How the site stored it
The same password can differ by a factor of a million depending on how it was stored. One RTX 4090 tries 288.5 billion NTLM hashes a second and 164.1 billion MD5, but only 184 thousand bcrypt — bcrypt is deliberately slow. So eight ASCII characters with symbols fall in under three hours where NTLM was used, and hold for over 500 years where bcrypt was. And the person typing the password does not get to choose which.
A Hangul syllable is worth two ASCII characters
The standard Hangul block holds 2,350 syllables. Counting a whole syllable as one character, each carries 11.2 bits — 1.7 times an ASCII character. Eight Hangul syllables therefore beat thirteen ASCII characters and fall short of fourteen. The catch is that many systems reject them, and without an input method you cannot type them at all.
What this table counts and what it does not
The times here assume a **randomly chosen** password searched from end to end. Human-made passwords do not last that long — dictionary words, keyboard runs, birthdays, and the ! or 1 tacked on the end are tried first. “P@ssw0rd!” counts as 59 bits for nine ASCII characters but falls in seconds. In the other direction, more cards divide the time by however many there are.
The usual accident is not cracking
Far more common is a password leaked from one site being typed into another. A password that would take years still falls the day the weaker site is breached, if it was used in both places. Not reusing it, and turning on a second factor, come before adding length.
Find it by alphabet and length
Alphabet size · Length
digits onlyAlphabet size 10
hexadecimalAlphabet size 16
lowercase onlyAlphabet size 26
Base32Alphabet size 32
lowercase + digitsAlphabet size 36
upper + lowercaseAlphabet size 52
letters + digitsAlphabet size 62
Base64Alphabet size 64
full ASCII with symbolsAlphabet size 94
Hangul syllablesAlphabet size 2350
How to read this
- Bits per character = log2(alphabet size). Multiply by length for the total.
- Time to crack = half the combinations ÷ guesses per second.
- The speeds are published hashcat measurements on a single RTX 4090.
- These assume a random password. Human-made ones fall far sooner.
- NTLM (Windows)2.89e+11 /s
- MD51.64e+11 /s
- SHA-2562.20e+10 /s
- WPA2 Wi-Fi2.53e+6 /s
- bcrypt1.84e+5 /s
Frequently asked questions
QHow long should a password be?
It depends on how it is stored. Twelve ASCII characters with symbols is 78.7 bits: 26,000 years against NTLM, 41 billion against bcrypt. Drop to eight and NTLM falls in under three hours.
QMore length or more symbols?
Usually length. One more ASCII character adds 6.6 bits, while widening from lowercase to full ASCII adds only 1.9 bits per character.
QIs a Hangul password stronger?
Each syllable carries 11.2 bits, 1.7 times an ASCII character. But few systems accept them and you cannot type them without an input method.
QAre these times real?
They assume a randomly chosen password searched end to end. Human-made passwords fall far sooner to dictionary attacks.
QWhat matters most?
Not reusing it. Typing a leaked password into another site is a far more common attack than cracking one.