Free Tool · Password Security

How Long Would It Take to Crack Your Password?

Written by James Batt CISSP · CEH · Last reviewed 10 September 2026

Type a password below and see roughly how long a modern attacker would need to guess it — and what actually makes the difference.

The short answer is length. A long password made of ordinary words beats a short one stuffed with symbols, every time. Swapping an o for a zero doesn’t help either — attackers have known that trick for twenty years. It’s also what the NCSC recommends: three random words.

One caveat worth more than the number itself: most passwords are never cracked. They’re stolen — from a breach at some other website, or typed into a convincing fake login page. A password that scores “centuries” here is worth nothing the day it turns up in a leak, if you’ve used it twice.

The checker is just below

At a glance

Instant — free, and nothing to sign up for

Private — nothing you type leaves your browser, and nothing is stored

Length beats symbols — and the page explains why

All the same — please don’t type your real password

Test a password

Type into the box and the answer updates as you go. Nothing you type leaves this page, and nothing is stored — but please still use something close to your real password rather than the real thing.

Password to test

Waiting for a password

What actually makes a password strong

Length, far ahead of anything else. Every extra character multiplies the work. Twelve is a sensible floor and sixteen is better.
Three random words beats a clever short one. It is longer, you can remember it, and it is what the National Cyber Security Centre recommends.
Substitutions fool nobody. Swapping o for 0 or a for @ has been in every cracking dictionary for twenty years.
Never use the same one twice. This matters more than strength. One breach at one website hands an attacker the keys to every account sharing that password.
Let a password manager do the remembering. Then every password can be long, random and different, and you only have to remember the one that opens it.
Turn on two-step sign-in wherever it is offered. It is the single thing most likely to save you when a password does get out.

Worried about your business rather than one password?

Weak and reused passwords are usually a symptom of something bigger — no manager, no two-step sign-in, and no idea which accounts exist. That is an afternoon’s work to put right.

Talk to James

How the timings are worked out. They assume an attacker who has already stolen a file of scrambled passwords and is guessing at them offline with a high-end graphics card — the realistic worst case, and much faster than guessing at a login screen. Figures reviewed September 2026 and they get shorter every year as hardware improves. Treat them as a sense of scale rather than a promise.

Who wrote this

James Batt

CISSP CEH Founder, Systems Secure

Twenty-five years as an IT architect in the oil and gas industry, designing multi-million pound systems for companies around the world, before going independent. These days the work is smaller and a good deal more useful: helping UK businesses get enterprise-grade security without an enterprise budget.

I built this checker because most of us were taught the wrong rules about twenty years ago and nobody ever sent a correction. A capital letter at the front and an exclamation mark on the end were never the point. Length is. And not using the same password twice matters more than either.

If you would rather sort this out properly across the whole business — a password manager, two-step sign-in, and an actual idea of which accounts exist — pick up the phone, or get in touch whichever way suits you.

Book a consultation Free · 30 minutes Call or text 07702 896 910 WhatsApp 07702 896 910 Email [email protected] Microsoft Teams [email protected]

No obligation · No sales script · You keep the findings either way

Should I use the same password for multiple sites?

No—this is one of the most common and dangerous mistakes. If one site is breached, attackers often sell your login details on the dark web. Criminals then use automated tools to try your email and password on hundreds of other sites—including your business systems, email, and banking.
One password = many points of failure. Use a different password for every account.

Should I change my passwords regularly?

Only if there’s been a breach or suspicious activity. Regular forced changes can lead to bad habits like weak or recycled passwords. Focus on creating strong, unique passwords and using multi-factor authentication (MFA) wherever possible.

If there’s no MFA option, how long should my password be?

Go long. Aim for at least 16 characters. Longer passwords take dramatically more time to crack—even with powerful tools. Adding special characters (like !, %, $, or &) increases the difficulty even more.

A strong, unique passphrase is your best line of defense.

What’s the safest way to remember strong passwords?

Use a password manager. These tools securely store and autofill your logins, so you only have to remember one strong master password. It’s safer and more convenient than writing them down or reusing them.

Are password hints or security questions safe?

In most cases, no. Security questions are often easy to guess or research—especially for business owners who have information online. Details like your first pet’s name, mother’s maiden name, or favourite football team can often be found through social media, old blog posts, or public records.

Attackers specifically look for this kind of data to bypass your password entirely.

If you can, treat them like passwords. Use random answers that aren’t true but are hard to guess—like Horse$Battery!43—and store them in your password manager.

What makes a good password?

A strong password is long, random, and unique. It should avoid anything personal—like names, dates, or common phrases—and skip predictable patterns like 123456 or qwerty.

Instead, use a passphrase with a mix of upper and lowercase letters, numbers, and special characters. These are harder to crack and easier to remember than short, complex strings.

Good example:
Coffee$Train!Lemon#84

Weak example:
Password123! or Company2024!

The longer and more random your password, the stronger your defense against brute-force attacks.