How long to crack a 14-character password

One GPU, fast hash: 1.3 billion years

A truly random 14-character password using letters, numbers and symbols takes about 1.3 billion years to brute-force when a leaked database uses a fast hash like MD5 (one high-end GPU, ~100 billion guesses a second), 13 million years for a 100-GPU cluster, and about 10¹⁶ years if the site used bcrypt. With lowercase letters only, one GPU needs 20 years.

Worst case for a randomly generated password. Check a password you made up yourself with the strength checker.

14-character password crack time table

Time to try every combination of 14 random characters. Rates are round orders of magnitude (see the calculator for where they come from).

Characters used	Entropy	Rate-limited login 100 guesses/hour	Leaked bcrypt hash ~10,000 guesses/s	Leaked MD5/NTLM, 1 GPU ~100 billion guesses/s	MD5, 100-GPU cluster ~10 trillion guesses/s
Numbers only (10)	47 bits	114 million years	3.2 centuries	17 minutes	10 seconds
Lowercase only (26)	66 bits	about 10¹³ years	204 million years	20 years	2.5 months
Upper + lowercase (52)	80 bits	about 10¹⁸ years	about 10¹² years	335 thousand years	3.3 thousand years
Letters + numbers (62)	83 bits	about 10¹⁹ years	about 10¹³ years	3.9 million years	39 thousand years
Letters, numbers + symbols (94)	92 bits	about 10²¹ years	about 10¹⁶ years	1.3 billion years	13 million years

Numbers only, 14 digits, on one GPU against MD5: 17 minutes. Red: under a month. Amber: under a thousand years. Green: longer.

Generate a random 14-character password

Characters

…

Made on your device with crypto.getRandomValues; never sent. More options on the password generator.

Other lengths

6 characters6.9 seconds
8 characters17 hours
10 characters17 years
12 characters151 thousand years
16 charactersabout 10¹³ years
20 charactersabout 10²⁰ years

All symbols, one GPU, fast hash. Each extra character multiplies the work by 94.

14-character password FAQ

How long does it take to crack a 14-character password?

A truly random 14-character password using letters, numbers and symbols takes about 1.3 billion years to brute-force when a leaked database uses a fast hash like MD5 (one high-end GPU, ~100 billion guesses a second), 13 million years for a 100-GPU cluster, and about 10¹⁶ years if the site used bcrypt. With lowercase letters only, one GPU needs 20 years. Human-chosen passwords of the same length usually fall far sooner, because attackers try leaked passwords, words and patterns before brute force.

Is a 14-character password secure?

A random 14-character password from all 94 printable characters has about 92 bits of entropy and is strong when it is generated randomly. NIST SP 800-63B recommends at least 15 characters when a password is the only factor, so go longer for important accounts or add two-factor authentication.

How many 14-character passwords are possible?

With all 94 printable ASCII characters there are 94^14 ≈ 4.2 × 10²⁷ combinations. With lowercase letters only, 26^14 ≈ 6.5 × 10¹⁹; with digits only, 10^14 ≈ 1.0 × 10¹⁴.

What does a strong 14-character password look like?

One generated at random, with no words, names, dates or keyboard runs, and used on only one site. The generator on this page makes one in your browser with crypto.getRandomValues. If you need to remember it, a 5–6 word passphrase is easier and usually stronger.