47 seconds: how long modern AI needs to crack the average employee password

01 What 47 seconds means

The Hive Systems password table is the standard reference for cracking benchmarks, updated each year against current commodity GPU hardware [ Hive Systems 2024 ] . The 2024 edition runs the maths against an Nvidia A100 cluster, which a serious attacker can rent on cloud GPU services for under USD 4 per hour. For a random, bcrypt-hashed password, a 5-character secret falls instantly, a 7-character one in 47 seconds, an 8-character one in about 5 hours, and a 12-character one holds for tens of thousands of years.

So far the headline reads as good news. A long, properly random password is still effectively unbreakable. The problem is the word random. Real passwords are not random. They are structured around a predictable template: a capital letter, a meaningful word, a number, a symbol, in that order. Almost every password your staff create follows it, and cracking tools skip the random search space entirely.

RECON 02:14

A modern cracker such as Hashcat, running a current rule set, tries those structured patterns first. The 8-character password that should take 5 hours to brute-force often falls in under a minute once the tool recognises it as capital-word-number-symbol. This is why 47 seconds is a realistic figure for an average employee password. Not because it is short, but because the human who chose it was, like all of us, predictable.

02 Why your policy creates false confidence

The policies most Filipino SMBs inherit from their MSPs were written between 2008 and 2014. They specify minimum length, complexity and rotation. Each of the three has aged badly, and together they manufacture the exact passwords crackers target.

Minimum length without a guard against dictionary patterns is meaningless. An 8-character password cracks in seconds if it is structured, while a 24-character password from a manager cannot be cracked in human lifetimes. The control that matters is randomness, not length. Complexity rules make it worse: "must contain a symbol" produces a trailing exclamation mark for everyone, and "must contain a number" produces the current year appended to a word. Cracking tools have been tuned for those habits since 2010.

The combined result is a policy that produces predictable passwords, rotated frequently, that crack in seconds against modern tooling. We see this exact configuration in roughly 7 of every 10 Filipino SMBs we engage with. Stolen credentials are already the single largest action in confirmed breaches worldwide, and the share has climbed every year for half a decade [ Verizon DBIR 2024 ] .

03 The three-layer replacement

The post-password world for an SMB has three layers. Each is implementable in a working week, and together they make cracking irrelevant.

Layer one is a password manager for everyone. Pick one of 1Password, Bitwarden or Dashlane; they are functionally equivalent for SMB use. Bitwarden has the cheapest enterprise tier at around USD 3 per user per month, 1Password has the cleanest experience, and Dashlane sits in the middle. Mandate that every business credential is generated by the manager at 24 characters with full complexity. Nobody should know any of these passwords, and nobody should need to. The user logs in once with one strong master secret or a biometric, and the manager fills the rest.

Layer two is multi-factor authentication on every service that supports it. Microsoft 365, Google Workspace, QuickBooks, Xero, your bank and your CRM all support it in 2026. Turn it on everywhere and standardise on an authenticator app rather than SMS, which is exposed to SIM-swap attacks. Even if an attacker cracks the password, they still need the second factor, and the credential dump alone gets them nothing. Microsoft's own data puts the reduction in successful credential attacks from MFA at between 95 and 99 percent [ Microsoft DDR 2024 ] .

Layer three is passkeys where supported. A passkey is a cryptographic key tied to your device that authenticates you without any password crossing the wire [ FIDO Alliance ] . It cannot be phished, cannot be GPU-cracked, and cannot be reused across services because each service gets a unique key. Microsoft 365, Google Workspace and Apple iCloud support passkeys today, and Microsoft is moving Entra ID toward a passwordless default across 2026. Enable them where you can, and keep managed passwords for services that have not caught up yet.

04 The two-week rollout

None of this needs a large budget. Most of the cost is calendar time, not money. The security investment with the biggest payoff for a Filipino SMB is identity: a password manager and MFA across the company address more of your attack surface than any firewall or antivirus refresh at the same cost. The whole rollout fits inside 14 days.

Two weeks in, the expected reduction in successful credential-based attacks runs between 95 and 99 percent. Compared with the median direct fraud loss we see in Philippine case data, the maths is straightforward. The 47-second crack time becomes a story you tell, not a vulnerability you carry. If you want a second pair of eyes on your authentication setup, a free audit runs a quick external check against your domain and tells you which services are exposed to credential attacks before an attacker finds them.