How Secure Is My Password?
Most people significantly overestimate the security of their passwords. Real security depends on two things: entropy (unpredictability) and uniqueness (not reused or previously breached). A password that looks complex can still be cracked in seconds if it follows a predictable pattern.
What Makes a Password Weak?
- Short length — fewer than 12 characters leaves limited entropy even with symbols
- Common words or patterns — "P@ssw0rd1", "Admin123!", and keyboard walks like "Qwerty!" are in every attacker's dictionary
- Personal information — names, birthdays, phone numbers, pet names, and sports teams are guessed early in targeted attacks
- Password reuse — one data breach exposes every site where you used the same password
- Predictable substitutions — replacing 'a' with '@', 'o' with '0', or 'e' with '3' adds almost no entropy; attackers apply these transformations automatically
How Hackers Crack Passwords
1. Brute-Force Attacks
A brute-force attack tries every possible character combination systematically. Speed depends on the hash function protecting the password:
| Hash Algorithm | Speed (1 GPU, ~2024) | Notes |
|---|---|---|
| MD5 | ~30–50 billion/sec | Obsolete — never use for passwords |
| NTLM | ~100+ billion/sec | Windows legacy — still common in breaches |
| SHA-256 | ~10–15 billion/sec | Fast — not password-safe without key stretching |
| bcrypt (cost 12) | ~1,000–10,000/sec | Purpose-built for passwords — much slower |
| Argon2id | <1,000/sec | Recommended by NIST SP 800-63B — memory-hard |
This tool's crack time estimates assume 10 billion guesses per second (appropriate for SHA-256 offline attacks). For bcrypt- or Argon2id-protected passwords, multiply the shown time by millions or more.
2. Dictionary Attacks
Rather than trying every combination, dictionary attacks use curated lists of known passwords and common words. The RockYou dataset (15 million real-world passwords from a 2009 breach) and the Have I Been Pwned database (10+ billion breached credentials) are standard tools for attackers. Any password appearing in a breach is permanently compromised, regardless of its apparent complexity.
3. Credential Stuffing
When one site is breached, leaked username/password pairs are automatically tried on hundreds of other sites. This attack succeeds whenever passwords are reused. It does not matter how strong your password is if you use it on multiple sites — one breach exposes all of them. Use a different password for every account.
4. Rainbow Table Attacks
Rainbow tables are precomputed lookup tables mapping common passwords to their hash values, enabling instant reverse lookups. Modern authentication systems defeat this by adding a unique random salt to each password before hashing. A properly salted hash cannot be attacked with a rainbow table.
Real-World Crack Times at 10 Billion/Second
| Password | Entropy | Crack Time |
|---|---|---|
password | ~0 bits (in dictionary) | Instant |
P@ssw0rd! | ~0 bits (in dictionary) | Instant |
abc12345 | ~37 bits (8 chars, small pool) | ~4 seconds |
Tr0ub4dor&3 | ~40 bits (in XKCD, dictionary) | Minutes |
| 12-char alphanumeric, random | 71.5 bits | ~230 years |
| 16-char all types, random | 102 bits | Billions of years |
The Role of Two-Factor Authentication
Even a strong password can be exposed through phishing or data breaches. Two-factor authentication (2FA) adds a second layer of proof — typically a time-based one-time password (TOTP) from an authenticator app. Even if your password is stolen, an attacker cannot log in without also having your second factor.
Best practice: strong unique password + 2FA for every important account.
What to Do Right Now
- Use a password manager (Bitwarden, 1Password, KeePass) to generate and store unique passwords for every site
- Enable two-factor authentication on email, banking, and any account that supports it
- Check your email at haveibeenpwned.com to see if any of your accounts are in known breaches
- Generate a new strong password here: use the secure password generator
FAQ
How fast can hackers crack passwords?
Against MD5 or NTLM hashes, a single modern GPU can try 30–100 billion passwords per second. Purpose-built algorithms like bcrypt or Argon2id are deliberately slow — around 1,000–10,000 per second — which is why the hashing algorithm matters as much as the password itself.
Do you store my password?
No. Everything runs locally in your browser. No password data is ever sent to a server. You can verify this in your browser's developer tools under the Network tab.
What is a dictionary attack?
A dictionary attack tries passwords from large lists of known words, common passwords, and previously breached credentials. Because these lists contain billions of entries, any password based on real words or common patterns is at serious risk.
What is credential stuffing?
Credential stuffing uses username/password pairs leaked from one site to automatically try them on other sites. Reusing passwords means one breach can compromise dozens of accounts.
How many bits of entropy does a secure password need?
Security professionals recommend 80+ bits of entropy for strong passwords. A randomly generated 16-character password using all character types achieves ~102 bits. Learn more in our entropy guide.
Generate a strong password now: secure password generator. Also read: Password vs. Passphrase.
We do not collect, store, or transmit any passwords.