The short answer is: No. In 2026, 8-character passwords are completely insecure.
Even if an 8-character password contains uppercase letters, lowercase letters, numbers, and symbols, modern hardware acceleration makes exhaustive brute-forcing trivial for any motivated attacker.
The Numbers: 8 Characters on Modern Hardware
Let's examine the total keyspace of an 8-character password utilizing all 95 printable ASCII characters:
Total Permutations = 958 ≈ 6,634,204,312,890,625 (~6.63 × 1015)
At first glance, 6.6 quadrillion sounds like a massive number. However, modern GPU cracking rigs running Hashcat compute NTLM and MD5 hashes at staggering speeds:
- Single Nvidia RTX 4090: ~10 billion guesses per second → 7.6 days to test 100% of the keyspace.
- 8x RTX 4090 Server: ~80 billion guesses per second → less than 23 hours.
- Cloud GPU Cluster (AWS / RunPod): ~1 trillion guesses per second → under 1.8 hours.
Remember that on average, a brute-force search finds the password halfway through the keyspace (50%), cutting these times in half.
Why Websites Still Ask for 8 Characters
If 8 characters is so dangerous, why do countless registration forms still say "Must be at least 8 characters"?
The answer is legacy inertia. The 8-character minimum was established in the 1980s and 1990s when CPUs computed thousands of hashes per second rather than billions. Product managers fear that raising the minimum to 16 characters will reduce conversion rates.
What Should You Do?
Never stop at the minimum required length. If a website requires 8 characters, treat that as a warning, not a recommendation. Create a password of at least 16 characters (which takes trillions of years to brute force) using a password manager.