Are password crack time estimates accurate? Only as illustrations. A time like “years” comes from an assumed guessing speed and a simple search model, not a deadline for your account. Real risk depends on whether guesses are limited, how the password is stored, and whether it follows a predictable pattern.
When you test a password in the Password Strength Checker, the time it shows comes from a hypothetical model. Below I explain what the model assumes, where it stops matching real life, and what to do instead of trusting a big number.
Table of Contents
Are password crack time estimates accurate for real accounts?
As arithmetic, yes. As a prediction, no. The checker divides the number of possible passwords by an assumed guessing speed and shows a duration. That tells you how large a search would be under one set of assumptions, not when someone will get into your account.
The Password Strength Checker page states that its estimate assumes 10 billion guesses per second. Treat that as an assumption, not a measured speed for your account and not a sign that anyone is guessing right now. When it shows Eons, the page itself calls the figure an illustration, not a guarantee.
Guess order matters too. A simple model treats every password as equally likely, so a randomly chosen one would be found about halfway through the search on average. Real attackers try common passwords, leaked passwords, personal clues and predictable patterns first. NIST SP 800-63B-4 (July 2025) cautions that estimating the entropy, meaning the unpredictability of a password measured in bits, of passwords people choose is challenging.
What does 10 billion guesses per second actually mean?
Take eight random lowercase letters. That is 26 choices per position, about 209 billion combinations. At 10 billion guesses per second, a full search takes roughly 21 seconds. Each extra random character multiplies the search by 26, which is why length does so much work.
Four words chosen at random from a 7,776-word list, such as the one in the Passphrase Generator, give about 51.7 bits of entropy (4 times log2 of 7,776). Under the same assumed speed, a full search takes on the order of days. That is a model result, not a verdict on everyday logins, but it is why I suggest five or six words for important accounts.
Are password crack time estimates accurate online and offline?
Two very different situations hide behind one number. Online guessing means trying passwords at a real login page. The service can slow or lock repeated failures, so 10 billion login attempts per second is not a reasonable reading of the display.
Offline guessing happens after a breach in which an attacker steals a database of password hashes. A hash is a one-way scrambled form of a password that a service stores instead of the password itself. With a copy of the hashes, guesses can be tested without the login page’s limits.
| Setting | Who limits guesses | What the 10 billion figure means |
|---|---|---|
| Online login | The service, through throttling and lockouts | Not a realistic attempt rate |
| Stolen hashes | Attacker hardware and the hashing method | A model only; real speed varies |
Offline speed depends on hardware and on the hashing scheme and its cost settings. OWASP’s Password Storage Cheat Sheet recommends salted, deliberately expensive hashing, with Argon2id as its first choice. A salt is a unique random value added to each password before hashing so identical passwords do not produce identical hashes. No single real-world cracking rate applies to everyone, and a leaked hash does not automatically reveal the password.
For IT and web beginners
If you build a login system, store passwords with a slow, salted algorithm, never a plain fast hash. The Password Hash Generator shows bcrypt, with a configurable cost factor, next to faster hashes in your browser, which helps with learning and testing. It does not replace your framework’s vetted password-hashing library.
Why can an entropy figure and a strength score disagree?
The Password Entropy Calculator computes length times log2 of the estimated pool size. The pool is inferred from the character classes you used (lowercase, uppercase, digits) plus the number of unique symbols. This is a search-space estimate. It means what it says only if every character was picked independently and uniformly at random from that pool. It cannot tell whether a phrase you invented is unpredictable.
The Strength Checker is a separate, pattern-aware assessment. Its page says it also evaluates common patterns, dictionary words and keyboard sequences. A long password can look impressive in a pool calculation yet earn a cautious score if it follows a familiar shape. Neither number proves how an attacker would behave, and I have not independently audited either tool. Both pages say analysis runs locally in your browser, and I am relaying that claim from the pages.
For a closer look at this mismatch, read High Password Entropy but Weak Strength Score: Why It Happens.
What can a long crack time still miss?
A big number says nothing about several common problems:
- Reuse: credential stuffing is when attackers automatically try leaked login details on other sites.
- Phishing: a fake page can collect even a very strong password.
- Malware on your device, which can capture what you type.
- A password that already appears in breach data.
The Password Leak Checker hashes your password in your browser with SHA-1 and sends only the first five characters of that hash to the Have I Been Pwned range service. This is k-anonymity, a method that lets a service answer a lookup without learning the full item. Matching is done locally. SHA-1 is used here only for lookup, never for storing account passwords. A not-found result means only that the password was not in that dataset. Check passwords only on tools whose privacy approach you trust.
What should you do instead of trusting years?
- Make it long and unique. CISA’s September 2024 tip sheet recommends random, unique passwords of at least 16 characters. NIST SP 800-63B-4 (July 2025) says verifiers, meaning the systems that check your password, must enforce a minimum length of 15 characters when a password is the only factor. It allows a minimum of eight when the password is used only within multifactor authentication. Not every site follows this. Generate yours with the Secure Password Generator rather than inventing one.
- Prefer random words for passwords you must remember. Do not rely on forced symbol rules, which NIST rejects.
- Check for exposure, and replace any password that is reused or found in breach data, even if a meter says years.
- Turn on multifactor authentication or passkeys. A passkey is a sign-in credential based on public-key cryptography, stored on your device, that replaces typing a password.
- Store passwords in a reputable password manager.
- Change a password when you have a reason, such as a breach or suspected compromise. NIST advises against routine periodic changes.
Frequently asked questions
Are password crack time estimates accurate?
They are accurate as simple math under stated assumptions, such as 10 billion guesses per second. They are not accurate predictions of when an account will be compromised, because real attacks vary in speed, order and method.
Can “eons” mean a password is uncrackable?
No. Eons is an illustrative model output. It does not cover phishing, reuse, malware or a password already exposed in a breach, so it is never a security guarantee.
Why might a long password still be weak?
If it follows a predictable pattern, uses personal details or appears in breach data, attackers can reach it early. Length helps most when characters or words are chosen randomly.
Does 10 billion guesses per second apply to website logins?
Not realistically. Services can throttle or lock repeated failed attempts. The figure is better read as a rough model for offline guessing against stolen hashes.
Does a leaked hash reveal my password?
Not automatically. An attacker must still test guesses against it, and salted, deliberately expensive hashing makes each guess costlier. Weak or common passwords remain more exposed.
Is it safe to type my real password into a checker?
The Password Ideas pages say analysis runs locally in your browser. As a habit, use only tools whose privacy approach you trust. If unsure, test a similar sample with the same structure instead.
Should I change a strong password regularly?
Not on a schedule. NIST advises against routine periodic changes. Change a password after a breach, suspected compromise or if you find it reused or exposed.
Next steps
So, are password crack time estimates accurate? They are useful for comparing options and unreliable as a promise. Years or eons describes a model, not your real risk.
Recap: use a long, random, unique password or passphrase for each account, check it against breach data, turn on multifactor authentication or passkeys, and change a password when you have a reason. The free Password Safety Checklist keeps these steps handy.
Related tools and resources on Password Ideas:
- High Password Entropy But Weak Strength Score
- Password Strength Checker
- Password Safety Checklist (PDF)
- Passphrase Generator
Sources and further reading
- Strength of Passwords
- Password Storage – OWASP Cheat Sheet Series
- Have I Been Pwned: API Documentation
- Authenticators
- Cybersecurity Best Practices | Cybersecurity and Infrastructure Security Agency CISA
- SP 800-63-4, Digital Identity Guidelines | CSRC
- Have I Been Pwned: Pwned Passwords
- Have I Been Pwned: Frequently Asked Questions
