In short: the famous crack-time table says an 8-character password with every kind of character takes 132 years to brute-force in 2026. That number only holds for a password that is random, has never leaked, and isn't protected by 2FA. Real passwords mostly aren't random, attackers try leaked and common ones first, and those fall almost instantly. What protects you: a long random password from a password manager, never reused, with 2FA on.
What the table measures
Every year, Hive Systems publishes a table of how long a brute-force attack would take to crack a password, by length and by the kinds of characters in it. The 2026 edition assumes a well-equipped attacker: 16 × RTX 5090 GPUs against passwords hashed with bcrypt (work factor 10).
- 8 random lowercase letters: about two weeks.
- 8 random characters, all types (upper, lower, numbers, symbols): 132 years.
The number keeps falling
The same 8-character, all-types password took 225 years in the 2024 table, 164 in 2025, and 132 in 2026. Hive Systems puts it at roughly 20 to 25% faster every year, as hardware gets better.
The catch
The table is the best case. In Hive Systems' own words, its numbers assume passwords that are randomly generated, a password that hasn't been part of a past breach, and that MFA isn't used or has been bypassed.
A real password usually breaks at least one of those: it's a word, a name and a year, or one you've used somewhere else that has leaked. And attackers don't start with brute force. They try all common and breached passwords before bothering to crack new ones, so a common, reused or dictionary-based password can fall instantly.
The example passwords in the video (password123, summer2024!, qwerty) are illustrative, not taken from a real breach list.
What actually works
- Long and random, generated by a password manager.
- Never reuse a password. One leak should open one account, not every account.
- Turn on 2FA. The 132-year table assumes you didn't.
Sources
- Hive Systems, Are your passwords in the green? (the 2026 table and its assumptions)
- Hive Systems, press release, 14 July 2026
The video is animated with code and the script was written with AI assistance; every figure above is checked against the sources.