Crack time calculator / 10 characters
How long to crack a 10-character password
One GPU, fast hash: 17 years
A truly random 10-character password using letters, numbers and symbols takes about 17 years to brute-force when a leaked database uses a fast hash like MD5 (one high-end GPU, ~100 billion guesses a second), 2 months for a 100-GPU cluster, and 171 million years if the site used bcrypt. With lowercase letters only, one GPU needs 24 minutes.
Worst case for a randomly generated password. Check a password you made up yourself with the strength checker.
10-character password crack time table
Time to try every combination of 10 random characters. Rates are round orders of magnitude (see the calculator for where they come from).
| Characters used | Entropy | Rate-limited login 100 guesses/hour | Leaked bcrypt hash ~10,000 guesses/s | Leaked MD5/NTLM, 1 GPU ~100 billion guesses/s | MD5, 100-GPU cluster ~10 trillion guesses/s |
|---|---|---|---|---|---|
| Numbers only (10) | 33 bits | 11 thousand years | 12 days | under a second | under a second |
| Lowercase only (26) | 47 bits | 161 million years | 4.5 centuries | 24 minutes | 14 seconds |
| Upper + lowercase (52) | 57 bits | 165 billion years | 458 thousand years | 17 days | 4 hours |
| Letters + numbers (62) | 60 bits | 957 billion years | 2.7 million years | 3.2 months | 23 hours |
| Letters, numbers + symbols (94) | 66 bits | about 10¹³ years | 171 million years | 17 years | 2 months |
Numbers only, 10 digits, on one GPU against MD5: under a second. Red: under a month. Amber: under a thousand years. Green: longer.
Generate a random 10-character password
Made on your device with crypto.getRandomValues; never sent. More options on the password generator.
Other lengths
- 6 characters6.9 seconds
- 8 characters17 hours
- 12 characters151 thousand years
- 14 characters1.3 billion years
- 16 charactersabout 10¹³ years
- 20 charactersabout 10²⁰ years
All symbols, one GPU, fast hash. Each extra character multiplies the work by 94.
10-character password FAQ
How long does it take to crack a 10-character password?
A truly random 10-character password using letters, numbers and symbols takes about 17 years to brute-force when a leaked database uses a fast hash like MD5 (one high-end GPU, ~100 billion guesses a second), 2 months for a 100-GPU cluster, and 171 million years if the site used bcrypt. With lowercase letters only, one GPU needs 24 minutes. Human-chosen passwords of the same length usually fall far sooner, because attackers try leaked passwords, words and patterns before brute force.
Is a 10-character password secure?
A random 10-character password from all 94 printable characters has about 66 bits of entropy and is reasonable when fully random, but within reach of a well-funded offline attack on a fast hash. NIST SP 800-63B recommends at least 15 characters when a password is the only factor, so go longer for important accounts or add two-factor authentication.
How many 10-character passwords are possible?
With all 94 printable ASCII characters there are 94^10 ≈ 5.4 × 10¹⁹ combinations. With lowercase letters only, 26^10 ≈ 1.4 × 10¹⁴; with digits only, 10^10 ≈ 1.0 × 10¹⁰.
What does a strong 10-character password look like?
One generated at random, with no words, names, dates or keyboard runs, and used on only one site. The generator on this page makes one in your browser with crypto.getRandomValues. If you need to remember it, a 5–6 word passphrase is easier and usually stronger.