Password strength: 12 letters beat 8 with symbols

Password strength depends on length before character variety. At the rate a rented GPU fleet cracks bcrypt hashes today, 12 lowercase letters last 14 times longer than 8 characters drawn from every symbol on the keyboard. That gap is why NIST sets a minimum character count for a strong password instead of asking for exotic symbols.

Every figure in the tables comes from one division: the number of possible passwords divided by a measured guess rate. The rate comes from Hive Systems, which measured it on rented GPUs, so anyone can redo the arithmetic by hand.

Password strength chart: how long to crack a password

Brute force means trying every combination, so the wait is the count of combinations divided by the attacker's guess rate, and each added character multiplies it by the size of the alphabet. The count of combinations is the alphabet size raised to the power of the length. Ten digits, 26 lowercase letters and 95 printable ASCII characters therefore give very different results at the same length.

The rate used in every table is the one Hive Systems measured in 2026 against bcrypt, a hashing method that makes each guess expensive. It is 138,675 guesses a second across two rented cloud machines that split the work. Every cell assumes a randomly generated password.

Time to crack by length and character set, bcrypt at the measured rate

A PIN is a password with a ten-character alphabet, so each extra digit adds little: ten digits last under a day, and twelve digits fall inside three months. Lowercase letters change the picture, because 12 of them reach 22 thousand years with no capitals, digits or symbols at all.

Time to crack at 8, 10 and 12 characters, bcrypt at the measured rate

The 95 printable ASCII characters are the 52 letters of both cases, 10 digits and 33 punctuation marks and symbols. That is every character a keyboard can type, and it is the strongest column in the tables.

Why a 12 character password beats 8 characters with symbols

Each new kind of symbol changes only the base of the calculation, while each added character changes the exponent, and the exponent carries the growth. Moving from a 26-character alphabet to a 95-character alphabet is a factor of less than 4. Going from 8 lowercase characters to 15 multiplies the possibilities by 26 to the 7th power, or 8,031,810,176.

Time to crack for two ways of building a password, bcrypt at the measured rate

The 12-character password with no symbols outlasts the 8-character password with every symbol by 14 times. Stretch both and the gap widens: 15 lowercase letters outlast 10 characters from the full set by 28 times.

A rule that asks for one capital letter and one symbol buys a factor of a few. Four more characters on a lowercase password multiply the possibilities by 456,976, and nobody has to remember where the punctuation went.

NIST password guidelines: 15 characters is required

Under the US federal standard, a login that relies on one secret alone has a mandatory minimum of 15 keystrokes, written as SHALL rather than as advice. NIST SP 800-63B says that verifiers and CSPs, the services that check and manage logins, SHALL require passwords used as a single-factor authentication mechanism to be a minimum of 15 characters. Eight and 12 characters both fall short of it.

The same document removes a habit that many people still treat as best practice. Verifiers and CSPs SHALL NOT require subscribers to change passwords periodically, and a change is forced only on evidence that the authenticator has been compromised. A calendar reminder to rotate a long password therefore adds nothing, while a password that has leaked needs replacing at once.

Why two password strength charts disagree by ten times

The alphabet an attacker is assumed to try decides the result, because the base of the power changes even when the hardware stays fixed. Two charts can both cite real measurements and still give different years for the same password. Most of them never print the alphabet they used, and that single choice moves the answer far more than the choice of graphics card.

Time to crack 8 characters by assumed alphabet, bcrypt at the measured rate

Letters and digits against the full printable set is a jump of more than ten times for the same eight keystrokes. The hashing method matters as well: Hive's table assumes bcrypt with a work order of 10, which means 1024 rounds of hashing for every guess. A chart that assumes a faster hash shows smaller times for the same password.

Reading a chart therefore starts with its alphabet and its hash, and only then with its years. A chart that states neither cannot be compared with any other.

When the chart does not apply: passwords that are not random

The tables describe one narrow attack, and anything a person picked, reused or had leaked falls outside it. Four conditions have to hold together for the numbers to apply:

• The attacker already holds a stolen hash of the password.
• The password is genuinely random.
• The password is absent from every earlier breach.
• Multi-factor authentication is off or bypassed.

Break any one of them and the tables stop applying. Breached and common passwords are tried before anything is brute forced, so a long phrase that appears in a breach list falls first. A dictionary word with letters swapped for digits is caught by rules written to expect exactly that substitution.

The first condition changes how the whole chart reads. An online login form with rate limiting never allows thousands of guesses a second, so the times describe an offline attack after a database is stolen, not an attack on a login page. That is also why the service's hashing method matters more than anything a user controls: a faster method divides every time in the tables by however much faster it runs.

Getting a strong password to 15 characters

Two habits reach 15 characters without memorizing noise: a phrase of unrelated random words, or a generated string stored in a password manager. A phrase of several unrelated words reaches the length easily and stays memorable. The words must be drawn at random rather than chosen, because a quoted sentence or a song lyric is a dictionary entry with spaces in it.

A generated random string kept in a password manager suits every account that never has to be typed from memory. One passphrase is memorized for the manager itself, and every other account gets a long unique string that nobody has to read. Long, random and never reused is the whole rule.

To create a random string of 15 or more characters for an account, use the password generator to generate one and save it in the manager. Repeat that for each account that currently shares a password with another.

Summary: length first, 15 required, assumptions matter

Eight symbols from the whole keyboard last 1.5 thousand years, while 12 plain lowercase letters last 22 thousand years. Three points carry the rest:

• Length before variety. A character added moves the exponent, while a symbol type added moves only the base.
• Fifteen is the minimum for a password used alone. NIST SP 800-63B says services SHALL require a minimum of 15 characters, and it forbids forced periodic changes.
• Every chart carries assumptions. A stolen hash, a random password, no earlier breach and no multi-factor step are all required, and the alphabet and hash change the years.

To check where an account stands, count the characters in your email password. If the count is under 15, replace it with a random string from your password manager or a passphrase.