An eight-character password mixing upper and lower case, digits and symbols would hold out for roughly 132 years against a well-equipped attacker. Stretch that to sixteen lowercase letters — no digits, no punctuation — and the same attacker faces about 9 billion years. That single contrast, lifted from the 2026 edition of Hive Systems’ perennially shared password chart, carries the most useful message of the whole exercise: raw length beats symbol soup.
- Length wins: sixteen random lowercase letters outlast twelve characters that use every character class.
- The clock is shrinking: the same eight-character mixed password fell from 225 years in 2024 to 132 years in 2026.
- Best-case framing: the table assumes a leaked hash, unlimited attempts and a password nobody has ever used before.
What the chart actually measures
The US cybersecurity firm published its 2026 edition on July 14, 2026, and says the chart has been viewed by more than 6 million people since it began producing it in 2020. What gets lost as the image travels across social feeds is the threat model. The table does not estimate how long someone needs to guess your credentials at a login form.
It assumes your password has already been stolen in a breach, stored as a hash — a one-way cryptographic digest that services keep instead of the plaintext — and that the attacker is grinding through candidate combinations on their own hardware. Server-side lockouts, rate limits and alerts protect the front door; a copied database has none of that.
The 2026 methodology is explicit about the rig. Hive rented 16 NVIDIA RTX 5090 consumer graphics cards in the cloud, split across two eight-card machines, after finding that twelve-card rentals were no longer available. The hash under attack is bcrypt at a work factor of 10 (1,024 iterations), a choice informed by breach data catalogued by Have I Been Pwned — where bcrypt has displaced MD5 — and by the default settings of popular tooling, which run from 10 to 12. Measured throughput reached 138,675 hashes per second across the rig, 24% above the 2025 setup.
One counterintuitive detail: gaming cards outpace datacentre silicon. Eight NVIDIA A100 accelerators, built for AI workloads, would need around 52 years to break an eight-character mixed-case password. Eight RTX 5090s need 23.
Why extra characters beat extra symbols
Every additional character multiplies the search space far more than adding a character class does, and the 2026 grid makes the gap obvious. Eight random lowercase letters fall in two weeks. Twelve lowercase letters stretch to 21,000 years, while twelve fully mixed characters reach 3 billion years. Sixteen lowercase letters hit 9 billion — comfortably ahead of the shorter mixed string.
That aligns with NIST‘s SP 800-63B-4 authentication guidance, which sets a 15-character minimum for passwords used as a single factor and explicitly discourages services from imposing composition rules that force users to mix character types.
The margins erode year on year. For the same eight-character mixed password against the same hash, Hive calculated 225 years in 2024, 164 in 2025 and 132 in 2026 — a decline of 20% to 25% annually. Exhausting every eight-letter lowercase combination costs roughly $3,400 (about €3,020 at October 2026 exchange rates) in rented GPU time.
The caveats that matter most
Hive concedes in its limitations section that its timings represent your best possible outcome: randomly generated passwords, never previously breached, with the attacker starting from nothing. Real campaigns open with dictionaries, credential dumps and human patterns. The firm measured the difference this year — against a single RTX 5090, an eight-character mixed password of the sort used in its own example fell in about three seconds once predictable variations were tried first. “P@ssw0rd2026” passes the complexity test on paper without inheriting the strength its column implies.
On artificial intelligence, Hive argues it does not accelerate brute force, since hash computation is raw throughput and AI hardware performed no better in testing. What AI has done, in the firm’s reading, is cheapen the work of provisioning and coordinating rented machines and sharpen the “thinking” phase — finding the vulnerability that exposes the database in the first place. That is an interpretation rather than a benchmark, though it fits the methodology.
Two further caveats: the service holding your password may use a weaker hash than bcrypt, compressing every timeline in the grid, and the table presumes no second factor, or an attacker who has bypassed it.
Practical takeaways
- Go long first: 15 characters or more, or a multi-word passphrase drawn at random.
- Keep it random and unique: reused keys and dictionary words collapse in seconds. Let a password manager generate and recall it.
- Check for exposure: several managers flag credentials that appear in known breaches.
- Add a second factor — or better, passkeys where supported, so a cracked password alone is not enough.
Hive’s chart works better as a persuasive device than as a stopwatch. Its figures are genuinely useful for pushing someone to lengthen a password, but read literally they radiate false comfort, because almost nobody uses truly random strings. The column that applies to a password you invented yourself is the three-second one. Expect the annual decline to keep compounding and the practical floor to drift upward: fifteen characters today is a reasonable target, and it will look conservative sooner than most users expect.