Password Generator · Practical guide
How Long Does It Take to Crack a 12 Character Password?
Anywhere from about 11 days to 150,000 years — the character mix matters as much as the length.
At a glance
It Depends on the Character Mix
A 12-character password is only as strong as the pool of characters it draws from. Using every character type — uppercase, lowercase, numbers, and symbols (94 characters total) — a random 12-character password has 78.7 bits of entropy and takes roughly 150,000 years to crack in an offline brute-force attack at 100 billion guesses per second, or about 1.5 million years in an online attack at 10 billion guesses per second.
Interactive tool
Password Generator
Enter your own values, then compare the result with the examples below.
Generated Password
12-Character Crack Times by Character Set
| Character Mix | Pool Size | Entropy | Offline Crack Time |
|---|---|---|---|
| Lowercase only | 26 | 56.4 bits | ~11 days |
| Letters + numbers | 62 | 71.5 bits | ~1,000 years |
| All character types | 94 | 78.7 bits | ~150,000 years |
Compare that with an 8-character password using all character types: just 52.4 bits and about 17 hours offline. Going from 8 to 12 characters multiplies the search space by 94 to the fourth power — about 78 million times.
How These Estimates Work
Crack time is the total number of possible passwords (pool size raised to the password length) divided by the attack speed: 10 billion guesses per second online, 100 billion offline. These figures assume the attacker must search the whole space, so a real attacker would find the password in about half that time on average. They also assume a truly random password — dictionary words and patterns crack far faster.
Frequently Asked Questions
Are these crack time estimates realistic?
They are worst-case brute-force estimates for fully random passwords. Real attackers try dictionary words and common patterns first, so non-random passwords crack much faster.
Is 12 characters enough in 2026?
For most accounts, yes — if the password is random and uses all character types. For high-value accounts like email and banking, 16 characters gives an enormous extra margin.
Does adding one symbol really help?
Only if the whole password is random. A single symbol at the end of a dictionary word is a known pattern and adds almost no real-world strength.
What about password cracking with GPUs?
The offline estimate already assumes a very fast attack at 100 billion guesses per second, comparable to serious GPU rigs. Random 12-character passwords still hold up for centuries.