Most people picture password cracking as a hacker hammering guesses into a login box. The reality is far more mundane, and far faster. A short, all-lowercase password doesn’t need a genius or exotic tools to fall — ordinary hardware, doing exactly what it’s built to do, gets there in seconds. Once you’ve seen how quickly modern kit chews through weak passwords, you stop trusting anything short. Here’s what’s actually happening under the hood, and why raw length is the only thing that saves you.
How cracking actually works (it’s not what films show you)
Attackers don’t sit typing guesses into a website. Sites lock you out after a handful of wrong attempts, so guessing online is hopeless — that’s the online scenario, and it’s slow by design.
The real danger is offline. When a company is breached, what leaks is usually a database of password hashes — scrambled fingerprints of each password. The attacker takes that file home and attacks it on their own hardware, with no lockouts, no rate limits, and no one watching. They guess a password, hash the guess, and check whether it matches. Billions of times a second. That’s the number that should worry you, and it’s the number our crack-time estimator is built around.
There are four flavours of guessing, fastest to slowest in real-world terms:
- Dictionary attacks try known words, leaked passwords and common phrases first. Because humans are predictable, this is devastatingly quick against real passwords.
- Rule-based attacks take dictionary words and apply the tricks people think are clever — capitalise the first letter, swap a for @, bolt 2026! on the end. These rules are built into the standard tools.
- Brute force tries every possible combination in sequence. Guaranteed to work eventually; “eventually” is the whole game.
- AI-assisted guessing trains on billions of leaked passwords to predict the specific patterns people actually use, sharpening all of the above.
The numbers, and how the estimator reaches them
To keep this concrete, I ran a handful of passwords through the same logic our tool uses. The estimate assumes an offline attack against a fast hash (think MD5 or NTLM, the kind still found in older breached databases), at an order of magnitude of around a hundred billion guesses per second on modern hardware — and a serious adversary runs many cards at once.
| Password | What it is | Estimated offline crack time |
|---|---|---|
12345678 | 8 digits | Instant |
password | 8 lowercase, a dictionary word | Instant |
P@ssw0rd2026! | ”complex” but pattern-based | Instantly (rule-based) |
Tr33F0rq! | 9 chars, genuinely random | Days (brute force) |
velvet-coffee-sunrise-mountain | 4-word passphrase | Effectively forever |
Look closely at rows three and four. P@ssw0rd2026! looks far stronger than Tr33F0rq! — it’s longer and busier. It falls almost instantly, because every substitution in it is one the cracking rules check first. The shorter genuinely-random string lasts far longer precisely because it isn’t guessable, only brute-forceable. Looking complex and being unguessable are completely different things. That gap is the single most useful idea on this page.
The estimator works the same way: it doesn’t just count characters, it weighs how predictable the pattern is. That’s why typing a dictionary word into the strength tester collapses the estimate even at a respectable length — and why a string of random words sends it through the roof.
Why length wins, mathematically
Every character you add multiplies the number of possible combinations, so difficulty grows exponentially with length and only linearly with complexity. A 16-character all-lowercase password has a vastly larger search space than an 8-character one stuffed with symbols. This is exactly why modern guidance — including NIST’s — now favours length over forced complexity. It’s not a stylistic preference; it’s the maths of brute force.
The practical rule I give people is blunt and easy to remember: under about 12 characters, assume it’s crackable; with a predictable pattern, assume it’s already cracked. The only defence that scales against hardware getting faster every year is raw, unpredictable length.
What to actually do
You don’t need to out-think the attacker, you need to make the maths hopeless for them. Use long passphrases — four or more unrelated random words — for anything you have to remember, and let a password manager generate long random strings for everything else. Two of my other guides go deeper: how to build a strong password, and the mistakes that make cracking trivial.
Then test your own. Drop a current password into the PassGuard Check estimator and watch where it lands — instant, days, or centuries. Every calculation runs locally in your browser; nothing you type is ever stored or sent. If the number surprises you, that’s the point.