A shocking number of people still guard their bank login with “123456,” then act surprised when someone hacks the password. Yet, the key was sitting on the doormat the whole time.
The scale backs that up. A June 2025 compilation tracked by Heimdal found 16 billion login credentials circulating online, pulled together from roughly 30 separate leaks, on top of a dataset where 94% of tested passwords turned out to be reused across two or more accounts. Reuse is what turns one careless password into a master key for someone’s whole digital life. This piece breaks down how password cracking actually works in 2026, what current hardware can do to a weak password, and where a VPN genuinely helps and where it doesn’t.
How a stolen password gets cracked
Cracking a password sounds technical, but the actual mechanics break down into a small number of repeatable moves.
Once a hacker has a copy of a site’s password database, the login page’s rate limits and lockouts stop mattering. There’s no failed-attempt counter running on a hacker’s own hardware, so the guessing happens offline, at whatever speed their equipment allows, for as long as they want.
Brute force and rainbow tables
A brute-force attack works through every possible character combination in order until one matches. It’s slow against a long password but fast against a short one, since an eight-character password made only of lowercase letters has a small enough set of combinations that consumer hardware chews through it in minutes. A rainbow table skips that math entirely. Instead of generating and checking guesses one at a time, it looks up a stolen hash in a massive precomputed list that already pairs common passwords with their hash values, which works instantly unless the site added a random string, a salt, to each password before hashing it. Salting breaks the lookup, since it makes every hash unique even when two people use the same password.
Why the hashing method decides your odds
The storage method a website chose years ago, long before you signed up, does more to protect your password than anything you typed. An old, unsalted MD5 hash can be tested billions of times a second on a decent graphics card. A modern method like bcrypt is built to be slow on purpose, adding thousands of extra computational rounds meant to punish anyone trying to guess at scale. The same password can take seconds to crack on one platform and centuries on another, and the difference comes down to a setting the user never sees.
What today’s hardware can do to a weak password
None of this stays abstract for long once you put real numbers next to real hardware.
A single NVIDIA RTX 5090, a consumer gaming card anyone can buy, tests roughly 220 billion MD5 guesses every second, according to Hive Systems’ 2026 password research. That number matters less on its own than what it costs to access. Cloud platforms rent out GPU power by the hour, and a determined attacker doesn’t need to own hardware at all, only a credit card and a few dollars. Verizon’s 2025 breach investigations report prices the average stolen password at $10 on criminal marketplaces, which says plenty about how little a weak one is actually worth to the person who cracked it.
220 billion password guesses per second from a single consumer GPU running MD5, according to Hive Systems.
94% of passwords are reused across two or more accounts, according to Heimdal.
$10 the average price for one stolen password on criminal marketplaces, according to Verizon.
37% of successful web attacks now start with brute force, up from 21% the year before, according to Verizon.
That combination, cheap rented power plus predictable human habits, is what makes weak passwords fall so quickly. Length changes the math more than almost anything else. Hive Systems’ research puts an eight-character password using a full mix of character types at roughly 132 years to crack under a strong hashing method, assuming it was randomly generated and never reused. Stretch that same password out with a few more random characters and the number climbs past anything worth calculating. Shrink it, or reuse it somewhere that already leaked, and it can fall in seconds instead.
Where AI actually changes the picture
Generative AI is reshaping plenty of attacks, though the guessing itself isn’t getting faster because of it. Anthropic’s Mythos Preview, a security-focused model the company restricts to a small coalition of partner organizations rather than releasing publicly, has found thousands of high-severity vulnerabilities across major operating systems and browsers, some of them decades old, according to Anthropic’s own account of the project. That’s a genuine capability jump, but it’s a reasoning task: spotting a flaw in code and working out how to exploit it. Brute-forcing a password hash sits closer to arithmetic than reasoning, and Hive Systems’ own testing found that AI-specialized hardware performed no better, and often worse, than an ordinary gaming GPU at grinding through hash guesses. Large language models asked to guess passwords directly did worse still, scoring under 1.5% accuracy in one comparison against traditional rule-based cracking tools. AI does help an attacker with logistics. Stitching together a rented multi-GPU cracking rig used to take real technical skill, and AI-assisted scripting has made that setup easier for less experienced attackers to pull off.
Where a VPN fits into the picture
None of this changes what a VPN is built to do, and it helps to be precise about where that overlaps with password security.
A VPN cannot make bcrypt faster or slower, and it cannot stop a company’s own database from being breached somewhere on the other side of the world. Those are server-side problems, decided by engineers you’ll never meet, long before you type a single character. A VPN protects the leg of the journey between your device and that login screen instead: the network carrying your credentials before they reach the site that will hash and store them.
Public Wi-Fi is the clearest example. Log into an account over an unsecured airport or cafe network, and anyone else on that same network with the right tools has a shot at intercepting what you type before the site’s own encryption kicks in, or at hijacking the session token your browser receives afterward. ZoogVPN wraps your traffic in AES-256 encryption from the moment you connect, so that data looks like noise to anyone else sharing the network. A kill switch cuts your connection outright if the VPN tunnel drops, instead of quietly falling back to an unprotected one, and ZoogVPN’s no-logs policy means there’s no separate record of your activity sitting on a server somewhere, waiting to become the next line on a breach list like Heimdal’s.
Worth knowing: pairing a VPN with a password manager covers two different gaps at once. ZoogVPN protects the network your credentials travel over, and a password manager makes sure each one is long and unique enough that a leak on one site never decides your risk on the next.
Encrypt the leg of the trip you control.
Habits that make a password hard to crack
Length and uniqueness do more for your security than any clever trick, and both are simpler to put into practice than people expect.
Build passphrases instead of passwords. Four or five unrelated words strung together beat a short word with symbols swapped in, since length affects the crackable keyspace far more than complexity does. A password manager can generate something even more random than that, which is the better option whenever a site allows it.
Give every account its own password. Reuse is what turns a single leaked site into a master key for accounts that were never actually breached. Credential-stuffing tools automate this for attackers, trying one leaked password against hundreds of other sites in minutes.
Turn on passkeys wherever they’re offered. A passkey ties your login to your device and a biometric scan instead of a typed string, so there’s nothing left for a phishing page or a cracking tool to capture.
Check whether your email has already been exposed. Free tools like Have I Been Pwned show which of your accounts have appeared in a known breach. If one has, treat that password as already compromised, not just weak.
Turn on multi-factor authentication, and skip the text-message option where you can. An authenticator app or a physical key holds up against SIM-swapping in a way that SMS codes don’t.
Frequently asked questions
A few questions come up often enough to answer directly.
How long does it take to crack a password in 2026?
It depends on length and the hashing method a site uses, but as a rough anchor, an eight-character password with a full mix of character types takes roughly 132 years to crack under a modern method like bcrypt, according to Hive Systems’ research, assuming it was random and hasn’t leaked before. A short, dictionary-based password with no symbols can fall in minutes on the same hardware.
Does length or complexity matter more?
Length. Adding characters increases the number of possible combinations far faster than swapping a letter for a symbol does, and a longer passphrase built from ordinary words is usually easier to remember than a short, symbol-heavy string besides.
Can a VPN stop my password from being cracked?
No, and it isn’t meant to. Cracking happens offline, after a database has already been stolen, somewhere a VPN has no reach. A VPN protects the connection between your device and a login page, which matters most on public Wi-Fi where credentials can be intercepted before they’re ever hashed.
Does AI make password cracking faster?
Not in the way most headlines imply. AI has made it easier to configure and rent a bigger cracking rig, and separately, AI models are getting very good at finding software vulnerabilities. Guessing passwords directly is a different kind of problem, closer to raw arithmetic, and AI tools have so far performed no better than ordinary graphics cards at that specific task.
What should I do if I find my password on a breach list?
Change it right away, on that site and anywhere else you reused it, and turn on multi-factor authentication if you haven’t already. Treat any account tied to that same password as compromised until you’ve updated it.
Your password can be strong. Your connection should be too.
- Diana BestaievaContent Writer at ZoogVPN. Diana deeply explores the newest technologies and shares valuable insights engagingly and comprehensively. Keeping up with the tech news, she makes in-depth content, explaining complex concepts with ease.
