Even in enterprise environments, passwords remain a core layer of access control, protecting everything from email and SaaS tools to cloud infrastructure and internal databases. But modern cracking tools and GPU-accelerated attacks can break even passwords that seem complex in minutes. In this environment, the typical eight-character passwords many users choose don’t stand a chance.
With modern hardware, attackers can try more than 100 billion potential passwords per second, dramatically shrinking the time it takes to break weak or predictable passwords. At Zip Security, we help teams keep their data safe, so we put together this resource to show how users may be putting themselves at risk. Here, we explore how long different types of passwords take to crack and what actually makes a password strong today. Share this with your team to help strengthen your IT defenses.
How Does a Password Guesser Work?
Password cracking uses automated software and high-performance hardware to guess passwords at scale. Attackers can test billions or even trillions of passwords per second using modern GPUs and cloud resources.
Common attack vectors include:
- Brute-force attacks, which try every possible character combination
- Dictionary attacks, which prioritize common words, phrases, and keyboard patterns
- Credential stuffing, which uses passwords leaked in previous data breaches
Modern attackers can scale these attacks cheaply and efficiently. As a result, passwords that once felt safe can fall almost instantly.
How Fast Can a Hacker Guess Your Password?
To understand just how vulnerable different passwords can be, it helps to look at real cracking times. The table below compares how long it takes attackers to guess passwords based on length and character variety.
This data illustrates a critical point for IT teams to impress upon their users: Even a password that seems complex isn’t as strong as it could be if it’s only eight characters long. Short passwords, even those with numbers and symbols, can fall in seconds. You might think that a password like “!aB2#xP9” would be pretty solid, but it turns out that something like “correct-horse-battery-staple” is stronger, simply because it’s longer.
And yet, research consistently shows that some of the most common passwords are short, easy-to-guess combinations like “123456,” “admin,” and “password.” Using a password like these is like putting your valuables into a safe and then writing the combination to the lock right next to it.
How to Create a Strong Password
Following National Institute of Standards and Technology guidelines and enterprise security best practices, IT teams should implement these rules for creating good passwords:
- Use a 15-Character Minimum: Set 15 characters as the baseline for every user account.
- Make a Unique Password for Every Account: Prevent credential stuffing, which is involved in 65% of security breaches, by requiring a different password for each account.
- Turn On MFA: Reduce account-takeover risk by enforcing multi-factor authentication on all critical systems.
- Block Easily Guessable Passwords: Ban sequential numbers, words in the dictionary, personal data like a user’s name and birthday (“John0623”), and default manufacturer passwords for routers and smart devices.
- Use Zero-Knowledge Vaults: Don’t rely on memory alone. Use a secure password manager with zero-knowledge encryption to generate and store long, unique passwords — even the service provider won’t be able to read them.
- Adopt Phishing-Resistant Sign-in Methods: Use passkeys, hardware security keys, and FIDO2-compliant devices instead of typed passwords and codes to reduce credential theft.
Strong password habits start with individual users, but managing IT and security at scale requires consistency. That’s why Zip Security is here to help teams enforce strong password policies and multi-factor authentication across every device and account. Sign up for a demo today and see how our access management and endpoint security solutions can help you keep your data safe.
Sources:
- https://pages.nist.gov/800-63-4/sp800-63b.html
- https://www.nist.gov/cybersecurity/how-do-i-create-good-password
- https://www.secretservice.gov/investigations/cyber/password
- https://sansorg.egnyte.com/dl/XpoE0oCRh6
- https://www.cisa.gov/secure-our-world/use-strong-passwords
- https://www.hivesystems.com/blog/are-your-passwords-in-the-green
