Graphs from cybersecurity expert show why your passwords should be at least 8 characters long

A report from cybersecurity firm Hive Systems (via CNBC) reveals how long it can take the average hacker to figure out the passwords that you use to protect your most important online accounts. For example, using numbers alone could allow a hacker to instantly discover your password anywhere from 4 to 11 characters long.

If you use only lowercase letters for a password, you might as well just give the data you're protecting directly to the hackers. Passwords with four to eight characters that are lower case only can be cracked instantly according to Hive while a password consisting of nine lower case letters can be discovered in 10 seconds. If the password requires 10 characters, that time expands to 4 minutes while an 11 character password using nothing but lower case letters can be figured out in two hours.

Using a mix of lower and uppercase letters, passwords of four through six characters can be cracked instantly according to the study. Passwords comprised of seven characters take only two seconds to discover while passwords with eight, nine, and 10 characters using both lower and upper case letters can be figured out in two minutes, one hour, and three days, respectively. An 11 character password using upper and lower case letters can hold off a hacker for up to five months.


Even if you were to mix in lower case and upper case letters along with numbers, using a password comprised of only four to six characters is not safe at all. And if you were to add symbols to the mix, even a six-letter password could be cracked instantly. The bottom line is that your password needs to be lengthy and adding one extra letter can make a huge difference in keeping your personal data safe.

For example, using lower and upper case letters, numbers, and symbols, a ten-letter password could be solved in five months according to the report. Using the same letters, numbers, and symbols, an 11-character password would take as long as 34 years to crack.

Hive suggests that at the minimum, a password used online should contain no fewer than 8 characters using a mix of mix of numbers, uppercase letters, lowercase letters and symbols. Want to have your mind blown? An 18 character password using the aforementioned mix of numbers, letters, and symbols would take up to 438 trillion years to be discovered by the average hacker.
The cybersecurity firm posted a couple of colorful graphs showing how hackers are able to figure out passwords faster now than just two years ago because of advances in technology.