How Long Should a Password Be?
By Akmal Ali · Published · Updated · 4 min read
Use at least 15 characters for a password that protects an account on its own, as the NIST SP 800-63B standard requires, and at least 8 when it is combined with a second factor. For accounts in a password manager, 16 or more random characters is a good default.
Length is the single biggest factor in how hard a password is to guess, more than capital letters, digits or symbols. The current US standard reflects that, and so does the arithmetic.
What does the NIST standard say?
The US National Institute of Standards and Technology sets the rules many organisations follow. Its Digital Identity Guidelines, SP 800-63B (revision 4, August 2025) say in their password requirements:
- At least 15 characters for a password that is the only thing protecting an account.
- At least 8 characters when the password is one part of multi-factor authentication, such as a password plus a code on your phone.
- Sites should allow at least 64 characters, so long passwords and passphrases fit.
- No forced mixtures or regular changes. Sites should not demand a capital letter, a number and a symbol, and should not make you change a password on a schedule, only when it may have leaked.
Why does length beat complexity?
For a randomly generated password, strength is measured in bits of entropy: each extra bit doubles the number of guesses an attacker needs. Every character adds bits, and adding more character types adds fewer bits than adding more characters.
| Random password | Characters to choose from | Entropy |
|---|---|---|
| 8 lowercase letters | 26 | 38 bits |
| 12 lowercase letters | 26 | 56 bits |
| 12 characters, all four types | 89 | 78 bits |
| 16 characters, all four types | 89 | 104 bits |
| 20 characters, all four types | 89 | 130 bits |
Entropy is the length × log₂ of the number of characters available. “All four types” means upper and lower case letters, digits and the 27 symbols our generator uses. These figures only hold for passwords picked at random: a word with a capital letter and “123!” on the end is far weaker than its length suggests, because attackers try those patterns first.
Passphrases: length you can remember
A passphrase is several words picked at random, such as four to six words drawn by rolling dice against a list. With a list of 7,776 words, the size of the widely used diceware lists, each word adds about 12.9 bits:
| Random words | Entropy |
|---|---|
| 4 words | 52 bits |
| 5 words | 65 bits |
| 6 words | 78 bits |
Six random words are about as strong as 12 random characters of all four types, and far easier to type on a phone. The words must be chosen at random: a line from a song or a well-known phrase is in attackers’ lists already.
Leaked passwords
A password that has appeared in a data breach is weak however long it is, because it is in the lists attackers try first. NIST’s guidelines tell sites to check new passwords against a list of common and compromised ones and to reject matches. The password strength checker recognises many common passwords and patterns on your device, though it doesn’t look up breach databases.
What to do in practice
- Use 16 or more random characters for accounts you log in to with a password manager. The password generator creates 16 by default.
- Use a longer passphrase for the few passwords you type, such as your computer or password manager: several random, unrelated words are easier to type and remember than symbols.
- Never reuse a password. A long password leaked by one site is useless as protection on every other site where it is reused.
- Turn on multi-factor authentication wherever it is offered. It protects the account even if the password leaks.
Password Generator
Choose the length and character types; the password is made with your browser’s secure random generator.
What if a site limits length or characters?
Some older sites cap passwords at 12 or 16 characters or reject certain symbols. Use the longest length they allow, and switch off the character types they reject. A 16-character password of letters and digits still has about 95 bits of entropy.
Frequently Asked Questions
Are passphrases safer than random passwords?
Not per character, but per thing you have to remember. Six random words have about 78 bits of entropy, the same as 12 random characters of all four types, and are much easier to type.
How long should a Wi-Fi password be?
WPA2 and WPA3 home networks accept 8 to 63 characters. Use at least 15 random characters: you rarely type it, and each device remembers it after the first time.
How long would a 16-character random password take to crack?
With all four character types it has about 104 bits of entropy. At 10 billion guesses a second, finding it would take around 30 trillion years on average, so in practice it falls only if it leaks.