How long does it take to crack a password? Brute force times for 2026 hardware

Password cracking speed depends on the hash algorithm and the hardware. An RTX 5090 can test about 10^10 MD5 hashes per second, 10^8 NTLM hashes per second, and about 10^4 bcrypt hashes per second (at cost factor 12). A password that's instantly cracked against MD5 might take years against bcrypt. But you can't control which hash a website uses, so you must assume the worst case: a fast hash.

By TechCompare · Updated August 2026

Security domain

Fundamentals

How passwords and hashing work

Topic focus

Brute force resistance

brute-force

How this is calculated

Cracking time estimates for a single RTX 5090 against MD5 (fast hash, worst case): 8 random chars (95^8) = ~3.5 days average. 10 random chars = ~86 years average. 12 random chars = ~780,000 years. 16 random chars = longer than the age of the universe. The takeaway: against fast hashes, 8 characters is already breakable, and 12 characters shifts the timeline from 'days' to 'effectively never.' Against bcrypt (slow hash): even 8 random characters takes millennia on a single GPU, but a determined attacker with a GPU cluster or cloud resources can parallelize the attack. Cloud GPU clusters can reduce cracking times by 100-1000x. Your password needs to survive the worst hash and the worst hardware, not the average.

Verdict

Use 16+ character random passwords. Against fast hashes, 8 characters is cracked in days. Against slow hashes with a GPU cluster, 8 characters is cracked in months. 16 characters is safe against any known attack, any hash, any hardware. The extra 8 characters cost you nothing with a password manager.