💥 Password Cracking Statistics 2026: 50 Data-Backed Facts
These password cracking statistics are drawn from primary sources published between 2024 and 2026: the Hive Systems annual Password Table, the NordPass Top 200 Most Common Passwords report, the Kaspersky brute-force study, the Specops Breached Password Report, the Verizon Data Breach Investigations Report, the FBI Internet Crime Complaint Center (IC3), Microsoft and NIST. Every figure is attributed inline so journalists, researchers and AI assistants can cite the original.
They answer one question: how fast can a password actually be cracked in 2026? The numbers span two worlds — the theoretical crack times for random passwords, and the far shorter real-world times for the weak, reused and dictionary-based passwords most people pick. Where a figure depends on hardware or hashing method, the assumption is stated.
Key Statistics at a Glance
How Long It Takes to Crack a Password by Length
The most-cited data point in password security is the Hive Systems Password Table, which estimates brute-force crack times by length and character set. The 2026 edition assumes an attacker renting 16 NVIDIA RTX 5090 GPUs against a bcrypt-hashed password. The lesson: every extra character multiplies the time, and length beats complexity.
- An 8-character password using upper case, lower case, numbers and symbols takes about 132 years to brute-force on a 2026 GPU rig. (Hive Systems, 2026)
- That same 8-character crack time has fallen fast as hardware improves: 225 years in 2024, 164 years in 2025, and 132 years in 2026 — roughly 20% faster each year. (Hive Systems)
- An 8-character lowercase-only password falls in about two weeks, down from three weeks a year earlier. (Hive Systems, 2026)
- An 8-character numbers-only password is cracked in about 15 minutes. (Hive Systems, 2025)
- An 8-character password with upper case, lower case and numbers (no symbols) takes about 62 years. (Hive Systems, 2025)
- Add two characters and the numbers explode: a 10-character full-complexity password takes roughly 800,000 years. (Hive Systems, 2025)
- A 12-character full-complexity password would take about 7.2 billion years to brute-force — longer than the age of the Earth. (Hive Systems, 2025)
- Even without symbols, a 12-character upper-lower-number password takes about 900 million years. (Hive Systems, 2025)
- The 2026 rig runs at 138,675 bcrypt hashes per second and costs roughly $8.54 an hour to rent — showing how cheap industrial-scale cracking has become. (Hive Systems, 2026)
- Hive's headline conclusion: "longer is almost always better than more complex" — get well past the 8-character bare minimum. (Hive Systems, 2026)
The table below shows how crack time scales with length once a password is genuinely random. Numbers use the Hive Systems 2025 edition (bcrypt, 12× RTX 5090) so all cells share one hardware baseline.
| Length (random) | Upper + lower + numbers | + symbols (full mix) |
|---|---|---|
| 8 characters | 62 years | 164 years |
| 10 characters | 240,000 years | 800,000 years |
| 12 characters | 900 million years | 7.2 billion years |
The Passwords That Crack Instantly
Those centuries-long numbers only apply to random passwords. The ones people choose are a different story, as the NordPass Top 200 Most Common Passwords report — analysed across 44 countries — shows.
- "123456" is again the world's most common password, topping the NordPass list. (NordPass, 2025)
- "123456" appeared more than 4.5 million times in the analysed data set. (NordPass, 2025)
- 78% of the world's most common passwords can be cracked in under one second, up from 70% the year before. (NordPass, 2025)
- "123456" has topped the list in six of the past seven years ("password" won the other). (NordPass)
- The most common passwords — names, keyboard walks and simple number strings — are cracked in less than one second because attackers try them first. (NordPass, 2025)
What Real Cracking Studies Find
The gap between theory and reality is captured best by Kaspersky, which ran a brute-force and smart-guessing analysis against 193 million real passwords pulled from dark-web sources. The chart below shows how quickly those real passwords fell.
Data visualisation: a horizontal bar chart of how fast real passwords fall. Nearly half (45%) of 193 million real passwords were cracked in under a minute, rising to 59% within an hour and 73% within a day. Only 23% were resistant enough to survive a year of attack. Windows are cumulative, so each longer window includes the shorter ones.
- 45% of 193 million real passwords were cracked in under one minute. (Kaspersky, 2024)
- 59% were cracked within one hour and 73% within a single day. (Kaspersky, 2024)
- Only 23% of passwords were resistant, holding out for more than a year. (Kaspersky, 2024)
- 57% of the passwords contained a dictionary word, the single biggest weakness attackers exploit. (Kaspersky, 2024)
- Even among passwords that looked strong, 39% could be guessed by smart algorithms in under an hour — far faster than blind brute force. (Kaspersky, 2024)
- Kaspersky's test rig, an RTX 4090 running at 164 billion guesses per second, cracked an 8-character same-case letters-and-digits password in about 17 seconds. (Kaspersky, 2024)
The Hardware: Billions of Guesses a Second
Modern cracking is a GPU arms race. Published Hashcat benchmarks show why fast, unsalted hashes like MD5 and NTLM offer almost no protection — and why slow hashes like bcrypt still matter.
- A single RTX 4090 computes about 164.1 billion MD5 hashes per second (164.1 GH/s) in stock Hashcat benchmarks. (Hashcat / Chick3nman benchmark)
- The same card reaches 288.5 billion NTLM hashes per second — the Windows hash that guards millions of corporate logins. (Hashcat benchmark)
- A rig of eight RTX 4090s exceeds 1.2 trillion MD5 hashes per second (1.2 TH/s). (Hashcat community benchmark)
- Slow hashing is the defence: the same RTX 4090 manages only about 184,000 bcrypt hashes per second — roughly 900,000 times slower than MD5, which is why properly hashed passwords buy years instead of seconds. (Hashcat benchmark)
- AI-assisted cracking made headlines when a PassGAN-based tool claimed to crack 51% of common passwords in under a minute and 71% within a day. (Home Security Heroes, 2023)
- Security researchers pushed back hard: cryptographers noted conventional crackers already break the same weak passwords just as fast, so the "AI breakthrough" framing was mostly hype — today's real speed gains come from GPU hardware, not AI. (Ars Technica analysis)
💥 Out-crack the crackers: use maximum length
Every statistic on this page points to one fix: length. A random 8-character password can fall in seconds once it is a dictionary word or reused — but a random 16-plus-character password is effectively uncrackable for centuries. Remembering one for every account is impossible, which is exactly what a password manager solves. NordPass generates a unique, maximum-entropy password for every login, stores them behind XChaCha20 encryption and a zero-knowledge architecture, and warns you the instant a saved password turns up in a breach — so the strong password is automatic instead of memorised.
Get NordPass →Affiliate link — we may earn a commission at no extra cost to you.
Cracked and Stolen at Scale
Most passwords are not brute-forced one at a time — they are stolen in bulk by malware, then cracked or replayed. The Specops Breached Password Report quantifies the flood.
- More than 6 billion passwords were stolen by malware in 2025 — exactly 6,004,274,474 in the 12-month window analysed. (Specops, 2026)
- The most-stolen password length was 8 characters, accounting for 1.07 billion passwords — the exact length attackers can crack fastest. (Specops, 2026)
- More than 4.4 billion of the stolen passwords were 8 to 12 characters long. (Specops, 2026)
- Complexity rules are no shield: passwords that met every requirement — such as "Admin@123" and "Pass@1234" — were still routinely compromised. (Specops, 2026)
- The most common base terms in stolen passwords were predictable words like admin, guest and cisco. (Specops, 2026)
- A single info-stealer strain, LummaC2, harvested more than 60.9 million credentials — about 60% of all malware-attributed passwords in the report. (Specops, 2026)
The Math: Why Length Beats Complexity
The reason length wins is exponential, not linear. Every extra random character multiplies the number of possible passwords an attacker must try.
- The full printable-ASCII character set is 94 characters, so the number of possible passwords of length n is 94 to the power of n. (character-set math)
- Each additional random character adds about 6.55 bits of entropy and multiplies crack time by 94. (log₂ of 94)
- A random 8-character password carries about 52 bits of entropy; 12 characters about 79 bits; and 20 characters about 131 bits — past the 128-bit threshold cryptographers treat as unbreakable. (entropy math)
- This is why a one-character increase does more for security than any reshuffling of symbols within a short password: length adds exponent, complexity only adds base. (entropy math)
What Cracked Passwords Cost
Cracked and stolen passwords are the entry point for the most common and most expensive cybercrime, as measured by the Verizon DBIR and the FBI IC3.
- 22% of breaches began with credential abuse — stolen or cracked passwords — the single most common initial-access vector. (Verizon DBIR, 2025)
- 88% of basic web-application attacks involved the use of stolen credentials. (Verizon DBIR, 2025)
- The FBI's Internet Crime Complaint Center logged 859,532 complaints in 2024. (FBI IC3, 2024)
- Reported losses reached $16.6 billion in 2024, a 33% jump on the year before. (FBI IC3, 2024)
- Phishing and spoofing was the single most-reported crime type, with 193,407 complaints — attacks built to harvest the passwords people reuse everywhere. (FBI IC3, 2024)
- The scale of automated attack is staggering: Okta reported blocking more than 3 billion identity attacks a month in 2024, most of them credential stuffing. (Okta, 2024)
The Defences That Actually Work
The data points to a small set of fixes that make cracking irrelevant. Microsoft and NIST agree on what they are.
- More than 99.9% of compromised accounts had no multi-factor authentication enabled — making MFA the highest-impact habit to adopt. (Microsoft)
- MFA blocks more than 99.9% of account-compromise attacks, according to Microsoft's own analysis. (Microsoft)
- NIST's 2025 guidance raised the bar on length: a single-factor password must now be a minimum of 15 characters, up from 8. (NIST SP 800-63B, Rev 4)
- Verifiers should support passwords of at least 64 characters so long passphrases are allowed. (NIST SP 800-63B)
- NIST now requires systems to screen new passwords against known-breach blocklists and forbids forced periodic password changes and mandatory composition rules. (NIST SP 800-63B, Rev 4)
- NIST also directs verifiers to allow the paste function in password fields, so password managers can fill long, random passwords smoothly. (NIST SP 800-63B)
- Human choice is still the weak link: 91% of people know reusing passwords is risky, yet 66% do it anyway, and only about a third use a unique password for every account. (LastPass; Google/Harris Poll)
What These Numbers Mean
Read together, the 50 statistics tell one story: a password's fate is decided by its length and randomness, not its cleverness. A random 12-character password is safe for billions of years; a common 8-character one falls in under a second, and 45% of real passwords crack inside a minute. Attackers are not out-thinking users — they rent cheap GPU fleets, steal passwords in the billions and try the obvious guesses first. The defence is mechanical, not motivational: a long, unique, random password on every account, a second factor, and a manager to hold them. That is what a password generator and a manager deliver without willpower. For more, see our roundups of how long it takes to crack a password, password attack statistics and password security statistics.
Frequently Asked Questions
How long does it take to crack an 8-character password in 2026?
It depends on the character set. A random 8-character password using upper case, lower case, numbers and symbols takes about 132 years to brute-force on a 2026 GPU rig (Hive Systems). But an 8-character lowercase-only password falls in about two weeks, and a numbers-only one in about 15 minutes. If the password is a common word or reused, it can crack in under a second.
What is the most common password in 2026?
"123456" remains the world's most common password, topping NordPass's list in six of the past seven years and appearing more than 4.5 million times in the analysed data. NordPass found 78% of the most common passwords crack in under one second, because people default to names, keyboard patterns and simple number strings.
Can AI crack passwords faster than traditional tools?
Not meaningfully, yet. A 2023 tool based on PassGAN claimed to crack 51% of common passwords in under a minute, but cryptographers noted conventional crackers already break the same weak passwords just as fast. The real speed gains in 2026 come from faster GPUs such as the RTX 5090, not AI. A long, random password defeats both.
How long should a password be to be effectively uncrackable?
Aim for length. A random 12-character password would take roughly 7.2 billion years to brute-force, and a 16-plus-character random password is safe for practical purposes. NIST's 2025 guidance sets a 15-character minimum for single-factor passwords and recommends supporting up to 64, because length matters far more than complexity.
How many passwords can a GPU guess per second?
A single RTX 4090 computes about 164 billion MD5 hashes and 288 billion NTLM hashes per second in Hashcat benchmarks, and an eight-card rig exceeds 1.2 trillion MD5 guesses per second. Against a slow hash like bcrypt the same card manages only about 184,000 per second — which is why the hashing method a site uses matters as much as your password.
Does length or complexity matter more for password strength?
Length. Each extra random character multiplies the possible passwords by 94 and adds about 6.55 bits of entropy, so adding characters beats reshuffling symbols in a short password. Hive Systems, NIST and Kaspersky agree: a long passphrase or random string is far stronger than a short "complex" one.
Methodology and Sources
Every statistic is attributed inline to the organisation that published it, with the year where applicable. Crack-time figures are estimates that depend on the attacker's hardware and hashing method; those assumptions are stated so readers can verify them. Figures were current as of August 2026. Primary sources:
- Hive Systems — Password Table 2026 and 2025 editions (brute-force crack-time estimates, bcrypt hashing, RTX 5090 GPU fleet)
- NordPass — Top 200 Most Common Passwords, 2025 (with NordStellar; 44 countries)
- Kaspersky — password brute-force study, 2024 (193 million real passwords analysed)
- Specops Software — Breached Password Report, 2026 (over 6 billion stolen passwords analysed)
- Hashcat — published GPU benchmarks (Chick3nman and community RTX 4090 results)
- Verizon — 2025 Data Breach Investigations Report (DBIR)
- FBI IC3 — 2024 Internet Crime Report
- Microsoft — account-security research on MFA effectiveness
- Okta — 2024 identity-attack telemetry
- Home Security Heroes / Ars Technica — PassGAN AI-cracking claims and expert response, 2023
- LastPass / Google & Harris Poll — password reuse behaviour surveys
- NIST — Special Publication 800-63B, Digital Identity Guidelines (Revision 4, 2025)
Note: crack-time estimates are reproduced as published and are not combined across differing hardware baselines. Hive Systems' table assumes bcrypt hashing on a rented GPU fleet; real-world times vary widely with the hash type a site uses.
