How Long Should a Password Be?
Published
Most advice about passwords focuses on symbols and capital letters. In practice, length is what makes a password hard to guess. Here is why, and how long your passwords should be.
Why length matters most
An attacker who tries to guess a password has to go through the possible combinations. Each extra character multiplies that number by the size of the alphabet. With the 90 characters of a typical generator (letters, numbers and symbols), a 12-character password has about 2.8 × 10²³ combinations, while a 16-character one has about 1.9 × 10³¹: roughly 66 million times more.
Adding symbols to a short password helps much less. Going from 62 possible characters (letters and numbers) to 90 adds about half a bit of entropy per character, while one extra character adds more than six bits.
Recommended lengths
- Everyday online accounts: at least 16 random characters, stored in a password manager.
- Important accounts such as email, banking or your password manager: 20 characters or more, plus two-factor authentication.
- Wi-Fi networks: 20 or more characters. You type it rarely, and a code can share it for you.
- A password you must memorize: a passphrase of five or six random words is easier to remember than random characters with the same strength.
Security standards point the same way. The latest revision of NIST's Digital Identity Guidelines (SP 800-63B) asks services to require at least 15 characters when a password is the only login factor, and to accept long passwords instead of imposing complex composition rules.
Random beats clever
Length only helps if the password is unpredictable. "Summer2026!" has eleven characters, but it follows a pattern that guessing tools try early. Replacing letters with numbers (p4ssw0rd) or adding a year doesn't help either.
A truly random password has no pattern to exploit. That's what the Password Generator does: it picks every character with your browser's cryptographic random number generator, without bias, and nothing leaves your device.
One password per account
Even a long password becomes weak if you reuse it. When a website is breached, attackers try the leaked email and password combinations on other services. Using a different password for every account limits the damage to a single site.
Nobody can remember dozens of long random passwords, and you don't need to. A password manager stores them, fills them in for you and warns you about reused ones. You only need to remember one strong master password.
Quick checklist
- 16 characters or more for normal accounts, 20 or more for important ones.
- Generated randomly, not invented.
- Different for every site.
- Saved in a password manager.
- Two-factor authentication turned on wherever it's available.