How do quantum computers crack passwords?
Quantum computers speed up password brute-forcing with Grover's algorithm, which searches an unstructured space in roughly the square root of the classical attempts. That is a quadratic speedup: it roughly halves a password's effective bit-strength, so a 128-bit space drops to about 264 quantum work. It does not break passwords instantly.
This square-root speedup is very different from the exponential break that Shor's algorithm threatens for RSA and elliptic-curve public-key cryptography. Shor targets the math behind key exchange and signatures, not the brute-force search of a password. For password strength, only the modest Grover speedup applies.
What does "quantum-proof" actually mean for a password?
A quantum-proof password simply has enough length and entropy that even a square-root Grover speedup leaves the brute-force work infeasible. Halving effective strength matters only if your starting strength was marginal, so the defence is straightforward: use longer, fully random passwords. The tool's 16+ character checklist reflects exactly this margin.
Note that post-quantum cryptography standardised by NIST (such as ML-KEM / FIPS 203 and ML-DSA / FIPS 204) protects key exchange and digital signatures against quantum attacks. That is a related but separate topic from password strength, which depends on length and randomness, not on the cipher protecting a key.
How we estimate crack times
We measure password strength with zxcvbn, which estimates the number of guesses an attacker needs based on real password patterns. We then model a classical attacker at about one billion (109) guesses per second. For the quantum estimate we apply Grover's square-root speedup to that guess count and assume roughly one million (106) quantum operations per second.
| Length | Classical (~109/s) | Quantum, Grover (~106/s) |
|---|---|---|
| 8 chars | ~ hours | ~ seconds |
| 12 chars | ~ thousands of years | ~ days |
| 16 chars | ~ 1015 years | ~ millions of years |
| 20 chars | ~ 1023 years | ~ 1010 years |
Even with a quantum square-root speedup, a 16+ character random password stays comfortably out of reach. The weakest real-world passwords are not cracked by quantum math but by appearing in breach lists such as Have I Been Pwned.
Frequently asked questions
Can a quantum computer crack any password instantly?
No. Quantum computers do not break passwords instantly. The relevant tool, Grover's algorithm, only gives a quadratic (square-root) speedup over brute force, so it roughly halves a password's effective bit-strength. A long, random password still requires an infeasible amount of work to guess.
Is a 16-character password quantum-safe?
A 16-character password drawn randomly from a full character set has enough entropy that even after halving the effective strength via a quadratic speedup, the remaining work stays impractical. That is why this tool treats 16+ random characters as a sensible quantum-resistance threshold for passwords.
Do password managers help against quantum attacks?
Yes. Password managers let you use long, unique, fully random passwords for every account without memorising them. High entropy and length are the real defence against a quadratic Grover speedup, so a manager is one of the most effective practical steps you can take today.
What is Grover's algorithm?
Grover's algorithm is a quantum search method that finds an item in an unstructured space in roughly the square root of the number of classical attempts. For password brute-forcing this means about a square-root speedup, halving effective bit-strength rather than breaking passwords outright.
Should I worry about quantum attacks today?
For passwords, not urgently. No quantum computer can brute-force a strong password today, and Grover only offers a square-root speedup. The bigger near-term concern is reused or breached passwords. Using long, unique passwords now keeps you safe against both classical and foreseeable quantum attacks.
Does this tool store my password?
No. Strength scoring and crack-time estimation run entirely in your browser, and your password is never sent to a server in plain text. Breach checks use a privacy-preserving k-anonymity model that only ever transmits a short, partial hash prefix.
Last updated: June 2026