TechCompare LogoTechCompare

How long does it take to crack a password? Brute force times for 2026 hardware

Password cracking speed depends on the hash algorithm and the hardware. An RTX 5090 can test about 10^10 MD5 hashes per second, 10^8 NTLM hashes per second, and about 10^4 bcrypt hashes per second (at cost factor 12). A password that's instantly cracked against MD5 might take years against bcrypt. But you can't control which hash a website uses, so you must assume the worst case: a fast hash.

By TechCompare · Updated

Security domain
Fundamentals
How passwords and hashing work
Topic focus
Brute force resistance
brute-force
Try the live Password Generator. Generate a passphrase or random string with custom rules.
Edit in the full tool

How this is calculated

Cracking time estimates for a single RTX 5090 against MD5 (fast hash, worst case): 8 random chars (95^8) = ~3.8 days average. 10 random chars = ~86 years average. 12 random chars = ~780,000 years. 16 random chars = longer than the age of the universe. The takeaway: against fast hashes, 8 characters is already breakable, and 12 characters shifts the timeline from 'days' to 'effectively never.' Against bcrypt (slow hash): even 8 random characters takes millennia on a single GPU, but a determined attacker with a GPU cluster or cloud resources can parallelize the attack. Cloud GPU clusters can reduce cracking times by 100-1000x. Your password needs to survive the worst hash and the worst hardware, not the average.

Verdict

Use 16+ character random passwords. Against fast hashes, 8 characters is cracked in days. At the stated bcrypt cost 12 rate, the same random password still averages about 10 to 100 years against a cluster that is 1000 to 100 times faster than one GPU. Sixteen characters is safe against known practical brute-force attacks. The extra 8 characters cost you nothing with a password manager.

More Passwords scenarios

Password length guide
Password length is the single most important factor in password strength.
View details ➜
Passphrase vs password
A password is a short string of mixed character types (like Kx9$mQ2!pR).
View details ➜
Password manager guide
A password manager is a single encrypted vault that generates, stores, and autofills strong unique passwords for every account you have.
View details ➜

Related guides

Password entropy
The mathematical measure of brute-force difficulty.
View guide ➜
Password length guide
Why length dominates brute-force resistance over complexity.
View guide ➜

Frequently asked questions

How long does it take to brute-force an 8-character password in 2026?
Against a fast hash like MD5 on a single RTX 5090 (about 10^10 guesses per second), roughly 3.8 days on average for a fully random 8-character password. Against bcrypt the same attack takes millennia on one GPU. Since you can't know which hash a website uses, the safe assumption is always the fast one.
Does the hash algorithm change cracking time?
Enormously. The same GPU that tests 10^10 MD5 hashes per second manages about 10^4 bcrypt hashes per second at cost factor 12, a million-fold slowdown, because bcrypt is designed to be expensive. That's why a breached database of MD5 hashes falls in days and a breached bcrypt database mostly holds.
Can attackers crack passwords faster with cloud GPUs?
Yes, parallelizing across a rented GPU cluster cuts cracking times by 100-1000x over a single card. That's the reason worst-case thinking matters: a password has to survive the worst hash and the biggest plausible cluster, not the average case. Sixteen random characters puts even that scenario past any practical horizon.

Related tools

CHMOD Configurator

Calculate Linux file permissions using checkboxes or octal numbers, then view the matching symbolic notation.

Use tool ➜

Text Encoding Converter

Convert between Text, Base64, Binary, Hexadecimal, and Decimal formats.

Use tool ➜

Cron Generator

Visually build standard 5-part cron expressions or translate them into readable schedules.

Use tool ➜