Generated locally using window.crypto.getRandomValues().
Estimated time required to brute-force a password using modern hardware capable of computing 100 billion hashes per second. Note how length drastically multiplies the time required.
| Length | Numbers Only | Lowercase Letters | Upper & Lowercase | Mixed (Numbers, Cases, Symbols) |
|---|---|---|---|---|
| 8 chars | Instantly | Instantly | 8 Minutes | 1 Hour |
| 10 chars | Instantly | 23 Minutes | 16 Days | 5 Years |
| 12 chars | 10 Seconds | 11 Days | 600 Years | 35k Years |
| 14 chars | 16 Minutes | 18 Years | 2M Years | 250M Years |
| 16+ chars | 27 Hours | 13M Years | Billions of Years | Billions of Years |
A strong password is your first line of defense. Here is what you need to know.
A password's strength relies exponentially on its length. An 8-character password with letters, numbers, and symbols can be cracked in minutes. A 16-character password using only lowercase letters would take centuries. Always prioritize length.
Entropy is a mathematical measure of unpredictability, calculated in bits. It answers a simple question: How large is the pool of possibilities the attacker has to guess from? An entropy above 80 bits is considered highly secure against modern offline attacks.
A good password is useless if it's stolen from a breached database. Never reuse passwords across different sites. Furthermore, always enable Two-Factor Authentication (2FA) (preferably using an authenticator app or hardware key).
Human brains aren't built to memorize dozens of 16-character random strings. A Password Manager securely stores your unique passwords in an encrypted vault, so you only need to remember one master password.
Try Proton Pass