40 characters of Base32 — 200 bits

How the site stored it

• NTLM (Windows)10^40.9 years
• MD510^41.2 years
• SHA-25610^42.1 years
• WPA2 Wi-Fi10^46 years
• bcrypt10^47.1 years

The same password can differ by a factor of a million depending on how it was stored. One RTX 4090 tries 288.5 billion NTLM hashes a second and 164.1 billion MD5, but only 184 thousand bcrypt — bcrypt is deliberately slow. So eight ASCII characters with symbols fall in under three hours where NTLM was used, and hold for over 500 years where bcrypt was. And the person typing the password does not get to choose which.

What this table counts and what it does not

The times here assume a **randomly chosen** password searched from end to end. Human-made passwords do not last that long — dictionary words, keyboard runs, birthdays, and the ! or 1 tacked on the end are tried first. “P@ssw0rd!” counts as 59 bits for nine ASCII characters but falls in seconds. In the other direction, more cards divide the time by however many there are.

Nearby lengths

Same alphabet, other lengths

Same length, other alphabets

The usual accident is not cracking

Far more common is a password leaked from one site being typed into another. A password that would take years still falls the day the weaker site is breached, if it was used in both places. Not reusing it, and turning on a second factor, come before adding length.

How to read this

• Bits per character = log2(alphabet size). Multiply by length for the total.
• Time to crack = half the combinations ÷ guesses per second.
• The speeds are published hashcat measurements on a single RTX 4090.
• These assume a random password. Human-made ones fall far sooner.