Crack time calculator / 12 characters
How long to crack a 12-character password
One GPU, fast hash: 151 thousand years
A truly random 12-character password using letters, numbers and symbols takes about 151 thousand years to brute-force when a leaked database uses a fast hash like MD5 (one high-end GPU, ~100 billion guesses a second), 1.5 thousand years for a 100-GPU cluster, and about 10¹² years if the site used bcrypt. With lowercase letters only, one GPU needs 11 days.
Worst case for a randomly generated password. Check a password you made up yourself with the strength checker.
12-character password crack time table
Time to try every combination of 12 random characters. Rates are round orders of magnitude (see the calculator for where they come from).
| Characters used | Entropy | Rate-limited login 100 guesses/hour | Leaked bcrypt hash ~10,000 guesses/s | Leaked MD5/NTLM, 1 GPU ~100 billion guesses/s | MD5, 100-GPU cluster ~10 trillion guesses/s |
|---|---|---|---|---|---|
| Numbers only (10) | 40 bits | 1.1 million years | 3.2 years | 10 seconds | under a second |
| Lowercase only (26) | 56 bits | 109 billion years | 302 thousand years | 11 days | 2.7 hours |
| Upper + lowercase (52) | 68 bits | about 10¹⁴ years | 1.2 billion years | 1.2 centuries | 1.2 years |
| Letters + numbers (62) | 71 bits | about 10¹⁵ years | 10 billion years | 1 thousand years | 10 years |
| Letters, numbers + symbols (94) | 79 bits | about 10¹⁷ years | about 10¹² years | 151 thousand years | 1.5 thousand years |
Numbers only, 12 digits, on one GPU against MD5: 10 seconds. Red: under a month. Amber: under a thousand years. Green: longer.
Generate a random 12-character password
Made on your device with crypto.getRandomValues; never sent. More options on the password generator.
Other lengths
- 6 characters6.9 seconds
- 8 characters17 hours
- 10 characters17 years
- 14 characters1.3 billion years
- 16 charactersabout 10¹³ years
- 20 charactersabout 10²⁰ years
All symbols, one GPU, fast hash. Each extra character multiplies the work by 94.
12-character password FAQ
How long does it take to crack a 12-character password?
A truly random 12-character password using letters, numbers and symbols takes about 151 thousand years to brute-force when a leaked database uses a fast hash like MD5 (one high-end GPU, ~100 billion guesses a second), 1.5 thousand years for a 100-GPU cluster, and about 10¹² years if the site used bcrypt. With lowercase letters only, one GPU needs 11 days. Human-chosen passwords of the same length usually fall far sooner, because attackers try leaked passwords, words and patterns before brute force.
Is a 12-character password secure?
A random 12-character password from all 94 printable characters has about 79 bits of entropy and is strong when it is generated randomly. NIST SP 800-63B recommends at least 15 characters when a password is the only factor, so go longer for important accounts or add two-factor authentication.
How many 12-character passwords are possible?
With all 94 printable ASCII characters there are 94^12 ≈ 4.8 × 10²³ combinations. With lowercase letters only, 26^12 ≈ 9.5 × 10¹⁶; with digits only, 10^12 ≈ 1.0 × 10¹².
What does a strong 12-character password look like?
One generated at random, with no words, names, dates or keyboard runs, and used on only one site. The generator on this page makes one in your browser with crypto.getRandomValues. If you need to remember it, a 5–6 word passphrase is easier and usually stronger.