These estimates apply to passwords hashed using NTLM, a legacy and relatively weak hashing algorithm.
| Chars | Numbers Only | Lowercase | Upper & Lower | Numbers & Letters | All + Symbols |
|---|---|---|---|---|---|
| 4 | Instantly | Instantly | Instantly | Instantly | Instantly |
| 5 | Instantly | Instantly | Instantly | Instantly | Instantly |
| 6 | Instantly | Instantly | Instantly | Instantly | Instantly |
| 7 | Instantly | Instantly | 1 sec | 2 secs | 4 secs |
| 8 | Instantly | Instantly | 28 secs | 2 mins | 5 mins |
| 9 | Instantly | 3 secs | 24 mins | 2 hours | 6 hours |
| 10 | Instantly | 1 min | 21 hours | 5 days | 2 weeks |
| 11 | Instantly | 32 mins | 1 month | 10 months | 3 years |
| 12 | 1 sec | 14 hours | 6 years | 53 years | 226 years |
| 13 | 5 secs | 2 weeks | 332 years | 3k years | 15k years |
| 14 | 52 secs | 1 year | 17k years | 202k years | 1m years |
| 15 | 9 mins | 27 years | 898k years | 12m years | 77m years |
| 16 | 1 hour | 713 years | 46m years | 779m years | 5bn years |
| 17 | 14 hours | 18k years | 2bn years | 48bn years | 380bn years |
| 18 | 6 days | 481k years | 126bn years | 2tn years | 26tn years |