skip to main content
Caltech
Information Management Systems and Services
IMSS  /  Services  /  Information Security  /  Information & Recommendations  /  Password Guidelines  /  Password Strength

Password Strength Comparision

This table illustrates how long it might take to brute‑force a password under specific assumptions.

Key Takeaways

  • Passwords under 8 characters are generally cracked very quickly
  • Length matters more than complexity
  • Adding symbols helps, but only when combined with sufficient length
  • Passwords 12+ characters with mixed types become extremely resistant to brute-force attacks

Actual attacks more often rely on phishing, malware, or credential reuse. Multi‑factor authentication is the most effective protection.

A table showing time to brute-force passwords by length (4–18 characters) and character type (numbers only, lowercase, mixed, etc.). For example: 9-character numbers-only: 2 hours 12-character mixed with symbols: 3 billion years…"

Image source: Hive Systems