How Long Does It Take to Crack a 16-Character Password?
A truly random 16-character password from the full 95-character printable-ASCII set holds about 105 bits of entropy. Brute-forcing it offline at a billion guesses per second would take far longer than the age of the universe — and even a quantum attacker, who only gets Grover’s square-root speedup, still faces a ~52-bit search. The word random does all the work.
The numbers behind “16 characters”
Crack time depends on the size of the character set and, crucially, on whether the password is genuinely random or a memorable phrase an attacker’s model can predict.
| Character set | Pool size | Entropy of 16 chars | Classical brute force @ 1e9/s | After Grover (√, @ same 1e9/s rate) |
|---|---|---|---|---|
| Lowercase only | 26 | ~75 bits | ~10^6 centuries | ~minutes |
| Lower + upper + digits | 62 | ~95 bits | ~10^9 centuries | ~days |
| Full printable ASCII | 95 | ~105 bits | ~10^12 centuries | ~weeks–months |
Figures are order-of-magnitude. The Grover column applies the √ speedup at the same hypothetical 1e9/s rate: time ≈ 2^(bits/2) ÷ 1e9. For 105 bits that’s 2^52.5 ÷ 1e9 ≈ 74 days; for 95 bits, 2^47.5 ÷ 1e9 ≈ 2.3 days; for 75 bits, 2^37.5 ÷ 1e9 ≈ 3 minutes.
Note that the Grover column never reaches “instant” — but it is also not the real-world picture. Halving 105 bits leaves ~52 bits of effective work — weak by modern key standards, and as the table shows, if a quantum computer could run Grover’s oracle at a classical billion-iterations-per-second, even 16 random characters would fall in weeks. It cannot. Real quantum gate/clock speeds, plus the enormous error-correction overhead per logical operation, make each Grover iteration vastly slower than a GPU guess. That practical slowness — not the math of the √ speedup — is what actually keeps a long, random password safe.
The catch: entropy, not length, is what protects you
Sixteen characters of Summer2026!!!!!! is not 105 bits. Password estimators like zxcvbn — the engine behind our checker — count guesses an attacker actually makes, modelling dictionary words, dates, keyboard walks and padding. A long but predictable password can collapse to a 30-bit search that falls in seconds.
To get real entropy:
- Use a generator, not your imagination. Humans are terrible randomness sources.
- Prefer length over exotic symbols once you are random — each extra character beats a fancier alphabet.
- Never reuse it. Check exposure at Have I Been Pwned; a breached password has effectively zero entropy.
Where quantum fits
The quantum threat to a strong, random 16-character password is real but modest: Grover halves the exponent, it does not eliminate it. The mechanism is covered in Grover’s Algorithm vs Your Password. If you let a password manager generate and store these strings, you get full entropy for free.