Is a long password better than a complicated one?

Usually, yes. Every extra character multiplies the guessing work, so length does more than swapping letters for symbols. Four or five random words strung together is long, easy to type and hard to guess.

My password is on the strong end of the table. Am I safe?

Only if it is random and you use it nowhere else. The table is for a password a hacker has never seen. If it has been used on a website that was hacked, or it is a common word with a number on the end, it can fall in seconds whatever its length.

A passkey signs you in with your phone or computer's face, fingerprint or PIN instead of a password. There is nothing to guess, reuse or type into a fake website, so the numbers on this page stop mattering. Use one wherever a website offers it.

Do I really need a password manager?

If you have more than a handful of accounts, yes. It makes a long random password for every website and fills it in for you, so you only remember one. It also refuses to fill in on a fake website, which catches a lot of scams.

How often is this page updated?

We check Hive Systems for newer figures every two months and update the table when they publish one. The date at the bottom says when we last looked.

How long does it take to crack a password in 2026?

All news

By Beyond™ · Published 07/11/2026 · Updated 07/11/2026

The short answer

An 8 character password made only of small letters can be guessed in about two weeks. Add capitals, numbers and a symbol and the same 8 characters hold out for about 132 years. Make it 14 characters and nobody alive will see it cracked.

Those numbers come from Hive Systems, a security firm that rents powerful computers every year and measures how fast they can guess passwords. We have put their 2026 figures into plain words below, with our own advice for New Zealand households and businesses.

But there is a catch, and it matters more than the table. Keep reading past it.

How long each kind of password lasts

The longest it could take to guess a random password by trying every combination, on 16 high-end gaming graphics cards (Nvidia RTX 5090), rented by the hour. Find your password's length on the left and the kind of characters in it along the top.

Length	Numbers onlylike 48201937	Small letterslike tuiparka	Small and capital letterslike TuiPArka	Letters and numberslike Tu1PArk4	Letters, numbers and symbolslike Tu1P@rk4
6 characters	Straight awayCracked	37 minutesCracked	2 daysCracked	5 daysCracked	1 weekCracked
8 characters	Straight awayCracked	2 weeksCracked	12 yearsNot for long	50 yearsNot for long	132 yearsNot for long
10 characters	20 hoursCracked	32 yearsNot for long	33,000 yearsNot for long	191,000 yearsNot for long	645,000 yearsNot for long
12 characters	3 monthsCracked	21,000 yearsNot for long	89 million yearsStrong	737 million yearsStrong	3 billion yearsStrong
14 characters	23 yearsNot for long	14 million yearsStrong	241 billion yearsStrong	2 trillion yearsStrong	15 trillion yearsStrong
16 characters	2,000 yearsNot for long	9 billion yearsStrong	653 trillion yearsStrong	10 quadrillion yearsStrong	75 quadrillion yearsStrong

Cracked under a yearNot for long safe until computers catch upStrong a million years or more

Source: Hive Systems Password Table 2026 , published 14/07/2026. Their full table runs from 4 to 18 characters; we show the lengths people actually use. The ratings are ours. The example passwords are made up to show the mix: please do not use them.

What the table assumes

When a website is hacked, the attackers usually walk away with a scrambled copy of everyone's password, not the passwords themselves. They then use rented computers to guess, scramble each guess the same way, and see which ones match.

The table assumes the website scrambled passwords well (with bcrypt, a common and fairly strong way for websites to store passwords), and that your password is completely random. It also assumes the attacker starts from nothing and tries every possible combination. That is the best case for you.

Plenty of websites scramble passwords more weakly than that, and some barely at all. On those, every time on the table shrinks a lot.

The catch: reused and common passwords

Attackers do not start from nothing. They start with lists of billions of real passwords from earlier hacks, and the common tricks people use on them: a capital at the front, a number and an exclamation mark at the end, an @ for an a.

If your password is on one of those lists, or is built the way most people build them, it does not matter how long or clever it looks. Hive Systems found passwords like that go in seconds. That is why using the same password on more than one website is the single biggest risk on this page.

You can check whether your email address has turned up in a known hack at Have I Been Pwned. If it has, change that password, and any others that were the same.

It gets a bit quicker every year

Graphics cards get faster and cheaper to rent, so the same password falls sooner each year. Here is how long Hive Systems measured for an 8 character password with capitals, small letters, numbers and symbols:

2024about 225 years
2025about 164 years
2026about 132 years

Same password, same kind of attack: roughly a fifth less time each year. A password that is only just safe today will not be in a few years.

Words beat symbols

A password you can remember can still be very strong if it is long. String together random words, picked by a password manager or by rolling dice, not by you. Using Hive Systems' measured speed, we worked out how long a phrase of random words from a standard 7,776 word list would last:

4 random wordsabout 835 years
5 random wordsabout 6 million years
6 random wordsabout 51 billion years

Five or more is our pick for the one password you do have to remember: the one that unlocks your password manager.

What we recommend

A password manager

It makes and remembers a long random password for every website, and will not fill one in on a fake page. Our setup guides walk you through it, one step at a time.

1Password guide Keeper guide Proton Pass guide

Two-step sign-in

A code from your phone as well as your password, so a guessed or stolen password is not enough on its own. Start with email, because email resets everything else. An authenticator app is better than a text message.

Passkeys

Your face, fingerprint or phone PIN instead of a password. Nothing to guess and nothing to type into a scam page. Google, Apple and Microsoft accounts offer them now, and more websites add them every month: look for Passkeys in your account's security settings.

Check how scam-proof your business is

Weak and shared passwords are one of the first things scammers look for. Our free Scam Shield check shows where your business is open, in a few minutes.

Free Scam Shield check

Free checks

Check a suspicious email, link or text before you click, and see whether someone could send email pretending to be you.

Free checks

Rather we sorted it?

We can set up password managers, two-step sign-in and passkeys for your household or business, and show everyone how to use them.

Book a free tech health check

Questions people ask

Figures from the Hive Systems Password Table 2026, used with credit. Words, ratings, the passphrase sums and advice are Beyond™'s own. We check for newer figures every two months; last checked 07/11/2026.

Tools from Beyond™

More tools

Most are free and open to anyone, no sign up. Anything that costs shows its price.