Can AI crack passwords? What changed and what still works

AI can help attackers guess passwords that humans made up, because it learns the patterns people use. It cannot break a long random password, get past a site's limit on login attempts, use a password that was never reused, or phish a passkey.

So the advice has not changed much. What has changed is how badly a predictable or reused password fails.

What AI changes about password cracking

Password guessing has always been about predicting people. Attackers who steal a database of scrambled (hashed) passwords run guesses through the same scrambling and look for matches. The best guesses are not random; they are the passwords people actually pick.

That is where machine learning fits. In the research paper behind most "AI cracks passwords" headlines, PassGAN, first published in 2017, the authors trained a model on real leaked passwords so it could "autonomously learn the distribution of real passwords" and generate new guesses that look like them. Combined with a standard cracking tool, it matched 51% to 73% more passwords than the tool did alone in their tests.

In plain terms: AI is a better guesser of human habits. It is good at the passwords a person would choose, such as a word, a capital letter at the start, a number and a symbol at the end. NIST's digital identity standard, SP 800-63B, describes exactly that habit. It notes that people respond to password rules "in very predictable ways," and gives the example of someone who would have chosen "password" choosing "Password1" or "Password1!" when forced to add characters.

Predictable patterns are what a model learns best. If your password follows one, assume it is easier to guess than it looks.

Why you should ignore the crack-time tables

You have probably seen a colorful chart claiming AI cracks an 8-character password in seconds and a 12-character one in years. Those charts depend on assumptions they rarely state: which hashing method the breached site used, what hardware the attacker has, and whether your password was random or human-made. A random 12-character password and "Summer2026!" have the same length and very different odds.

This post does not include a table for that reason. NIST's own wording is enough: offline attackers can "compute many billions of hashes per second," which is why passwords that might be cracked offline need to be "orders of magnitude more complex" than those that only face online guessing.

What AI does not change

It cannot beat the login limit. On a live sign-in page, an attacker is not cracking anything. They are guessing, one attempt at a time, and the site decides how many guesses they get. NIST requires services to limit consecutive failed attempts on an account to no more than 100. A clever model that needs thousands of tries gets nowhere.

It cannot guess randomness. A model predicts what humans tend to do. A password made by a generator, or a passphrase of unrelated random words, has no human pattern to learn. NIST calls length "a primary factor" in password strength, and for a password used on its own it now requires at least 15 characters.

It cannot use a password you never reused. Plenty of account takeovers involve no cracking at all: a password leaked from one site is simply tried on others. A unique password per site turns that leak into a dead end.

It cannot phish a passkey. A passkey only answers the real website it was made for, so there is nothing for a fake page to collect. Our guide to what a passkey is explains how.

It does not touch the hashing. NIST requires sites to store passwords "salted and hashed" with a deliberate cost, so that each guess is "more expensive for an attacker." A smarter guess list still has to pay that cost for every attempt.

Where AI is a bigger risk: phishing

If AI threatens your password, the likelier route is not guessing it but asking you for it. The FBI warned in December 2024 that criminals use generative AI in phishing and that it "can correct for human errors that might otherwise serve as warning signs of fraud." So an email without typos proves nothing.

NIST is blunt about the consequence: "Passwords are not phishing-resistant." A strong password typed into a fake page is lost the moment you press enter. That is why the last two steps below matter more than any password rule. For the signs that still work when the grammar is perfect, see our guide on how to spot a phishing email.

How to protect your passwords from AI, step by step

These five steps follow NIST SP 800-63B and CISA's Secure Our World password guidance.

Make passwords long. CISA recommends at least 16 characters. For the few you must type from memory, a passphrase of several unrelated random words works; CISA suggests 4 to 7. Our guide on how to create a strong password shows the method, and the passphrase generator picks the words for you.
Make every password unique. One account, one password. This single habit means a leak at one site stays at that site.
Let a password manager make and remember them. CISA calls a password manager "one of the easiest ways" to protect accounts, and NIST requires sites to allow password managers and autofill. If you are wondering whether putting everything in one place is wise, read are password managers safe.
Turn on two-factor authentication. CISA's MFA guidance puts it simply: even if someone steals your password, "they won't be able to meet the second step requirement." An authenticator app or security key is stronger than text messages; our ranking of two-factor methods explains why.
Switch to passkeys where you can. They replace the password with a key your device holds, which removes guessing, reuse and phishing in one move.

Then check whether any password you use has already leaked. NIST requires sites to reject passwords found in breach lists, which tells you how attackers think: leaked passwords are tried first. Our guide on checking if your email was in a data breach walks through it.

What to stop doing

Stop changing passwords on a schedule. NIST now says services must not force periodic changes. Change a password when there is a sign it was exposed.
Stop adding a symbol to a word and calling it strong. "Password1!" is the textbook example of a predictable pattern.
Stop using personal details. NIST lists context-specific words, such as the service name or your username, among the passwords sites should block. Names, birthdays and pets belong in the same bin.
Stop reading codes to anyone. The FBI's May 2025 alert says never to provide a two-factor code to anyone over email, text or a messaging app.

Frequently asked questions

Can AI guess my password?

It can guess a password that follows a common human pattern more easily than older tools could. It has no real advantage against a long random password or passphrase, and on a live login page it is limited by the same attempt limits as anyone else.

How fast can AI crack a password?

There is no honest single number. It depends on how the breached site stored the password, the attacker's hardware, and whether the password was random. Charts that give one answer per length leave those out, so this post does not repeat them.

Will AI make passwords obsolete?

Passwords are already being replaced, but by passkeys rather than by AI. NIST's standard requires services at its AAL2 level to offer a phishing-resistant option, and passkeys are the kind most people can use today.

Is a 16-character password safe from AI?

A random 16-character password, or a passphrase of several random words, is not the kind of password a model is good at guessing, and it meets CISA's guidance. It still needs to be unique, and it still cannot protect you from a phishing page, so add two-factor authentication or a passkey.

Does AI make password managers less safe?

No. A manager's vault is protected by your primary password and its encryption, not by anything a pattern-learning model gets better at. The bigger risk is a weak primary password, so make that one a long passphrase.

Protect the account that resets all the others

Almost every password reset lands in your inbox, so your email account deserves your strongest passphrase and two-factor authentication. Secria Mail sign-up is a name, the address you want and a password, with no phone number. Your mailbox is locked with a key made from your password, on your device, and you get a 12-word recovery phrase. See how Secria Mail works or create a free account.