Each additional character multiplies the search space rather than adding to it.
Some questions about time have clean answers. How long since a date, how many days until a deadline, what the hour is somewhere else right now. Arithmetic settles them.
Then there are questions where the arithmetic is easy but the answer depends entirely on assumptions you have to state out loud. “How long would it take to crack my password” is one of those. You will find charts online offering confident figures, colour-coded from red to green. Most of them quietly bury the assumptions that produce the numbers, and the numbers move by many orders of magnitude when those assumptions change.
The underlying maths is worth understanding, because it explains why length matters far more than the complexity rules most of us were taught.
The calculation
A password drawn at random has a number of possible values equal to the size of the character set raised to the power of the length. Nothing more complicated than that.
Take the full set of printable characters on a standard keyboard, which comes to 94 options if you count upper and lower case letters, digits, and punctuation. Then:
- 8 characters gives about 6.1 × 10¹⁵ possibilities
- 12 characters gives about 4.8 × 10²³ possibilities
- 16 characters gives about 3.7 × 10³¹ possibilities
Adding four characters to an eight-character password does not make it 50 percent stronger. It multiplies the search space by roughly 78 million.
Character variety matters too, though less dramatically. At 12 characters:
- lowercase letters only: about 9.5 × 10¹⁶ possibilities
- letters and digits: about 3.2 × 10²¹
- full printable set: about 4.8 × 10²³
Turning possibilities into time
Here is where the honest version has to state its assumptions, because a possibility count is not a duration until you specify how fast someone is guessing.
Assumption one: the attacker has stolen a database of password hashes and is guessing offline on their own hardware, at one trillion (10¹²) attempts per second. Assumption two: on average, a randomly chosen password is found after searching half the space.
On those assumptions, and only those:
- 8 characters, full set: around 51 minutes
- 12 characters, lowercase only: around 13 hours
- 12 characters, letters and digits: around 51 years
- 12 characters, full set: around 7,500 years
- 16 characters, full set: around 5.9 × 10¹¹ years
Now change one assumption. If the service stored its passwords using a slow, memory-hard hashing function as current guidance recommends, and the attacker manages only one million attempts per second, the eight-character password moves from under an hour to roughly 97 years, and the twelve-character one becomes unreachable by any margin that matters.
That is the crucial and usually omitted point. The single biggest variable in these calculations is not your password. It is how the service you handed it to chose to store it, and you have no visibility into that decision or control over it.
Which is the actual argument for length. You are not optimising against a known attacker speed. You are buying margin against a defence quality you cannot inspect.
Why none of this describes the common case
Every figure above assumes the attacker is guessing blindly. In practice they rarely need to.
If your password is a word, a name, or a date, with the usual modifications applied, no exhaustive search is required. Guessing tools work through dictionaries and known patterns first, and human-invented passwords sit almost entirely inside that space. The calculations above apply only to passwords that were generated at random. A memorable password with 12 characters and a predictable structure does not get 7,500 years of protection. It may get seconds.
And if your password was reused on a service that leaked, its strength is irrelevant. It is already on a list, being tried elsewhere automatically. Time-to-crack does not enter into it.
This is why NIST Special Publication 800-63B-4 discourages the composition rules many of us learned, one capital and one digit and one symbol, on the grounds that they produce predictable results, and no longer recommends forced periodic changes for the same reason. It emphasises length, support for genuinely long credentials, and screening passwords against lists of known compromised values.
What to actually do
Twelve characters generated at random is a sensible working floor for ordinary accounts, and setting a password generator 12 characters long takes about as long as reading this sentence. For anything important, go longer: CISA’s guidance recommends at least 16 characters, on the reasoning that longer is straightforwardly stronger and there is no cost to you when software is doing the remembering.
The word generated is doing real work in that sentence. A password you invented does not inherit these numbers, however long it is.
Two things then matter more than squeezing out extra characters. Every account needs a different password, so that one breach stays contained. And multi-factor authentication needs to be on wherever it is offered, starting with your email, because email is the reset path for everything else. A long random password does nothing at all if it was phished rather than guessed, and phishing is considerably more common than brute force. The UK National Cyber Security Centre’s guidance on managing passwords covers both, and notes that stored credentials autofill only on the site they were saved for, which quietly makes lookalike login pages easier to notice.
The honest answer
How long would it take to guess your password? If it is genuinely random and reasonably long, longer than anyone will bother trying, on any assumption you care to make.
If you invented it yourself, the question is not really about time at all. It is about whether it is already on a list. And that answer arrives much faster than any of the numbers above.