How long should a password be?

Use 16 random characters for anything that matters, and never fewer than 12. Below 12, an attacker who steals a password database can exhaust the possibilities on hardware you could rent for an afternoon. Above 16, you have left the realm of brute force entirely and your remaining risks are phishing, reuse, and malware.

Here is where those numbers come from.

The arithmetic

Every character you add multiplies the attacker’s work by the size of the character pool. With uppercase, lowercase, digits, and a typical symbol set, that pool is 86 symbols. So the number of possible passwords is 86 raised to the length.

Assume the worst realistic case: an attacker has stolen the password database and is grinding it offline on a GPU cluster at 100 billion guesses per second against a fast hash.

Random password length, entropy, keyspace, and average crack time

Length	Entropy	Possible passwords	Average time to crack
8	51.4 bits	3.0 × 10^15	4 hours
10	64.3 bits	2.2 × 10^19	3 years
12	77.1 bits	1.6 × 10^23	26,000 years
14	90.0 bits	1.2 × 10^27	190 million years
16	102.8 bits	9.0 × 10^30	1 trillion years
20	128.5 bits	4.9 × 10^38	10^19 years

Two things jump out. The first is how fast eight characters falls: hours, not years. The second is how abrupt the transition is: two extra characters between 10 and 12 turn three years into twenty-six thousand.

You can check any length yourself rather than taking the table on faith.

Why length beats complexity

Adding a character multiplies the search space by 86. Adding a character type widens the pool once and then stops helping.

Compare two passwords:

• xK9#mQ2$vL: 10 characters, all four types, 64 bits.
• qmvtzbklrxwd: 12 characters, lowercase only, 56 bits.
• qmvtzbklrxwdhn: 14 characters, lowercase only, 66 bits.

Fourteen random lowercase letters beat ten characters with every symbol class, and are far easier to type on a phone. This is why NIST SP 800-63B removed mandatory composition rules and told verifiers to require length instead: complexity requirements push people toward Password1! and produce no measurable security gain.

The condition everyone skips

All of the above assumes the password was chosen at random. That assumption is doing enormous work.

Tr0ub4dor&3 is eleven characters using every character class. The formula says 70 bits. Its real strength is closer to 28, because an attacker does not guess character by character: they take a dictionary word, apply standard letter-to-number swaps, capitalise the first letter, and append a symbol and a digit. That is a few hundred million candidates, not 10^21.

If you chose it, the length table does not apply to you. Run it through a pattern-aware strength checker instead, which prices the shortcut rather than the brute-force path.

What about passphrases?

A passphrase reaches the same entropy with more characters but far less memory strain. Each word drawn at random from the 1,296-word EFF list adds 10.34 bits:

Random passphrase word count, entropy, and equivalent password length

Words	Entropy	Equivalent random password
4	41.4 bits	7 characters
5	51.7 bits	8 characters
6	62.0 bits	10 characters
7	72.4 bits	12 characters

Per character, a passphrase is much weaker. Per unit of human effort, it wins decisively: six random words are easier to hold in your head than ten random characters, and you will actually use them. That makes passphrases the right choice for the few passwords you must type from memory, and random characters the right choice for the hundreds your software handles.

Where length stops mattering

Past roughly 100 bits, more length buys nothing against guessing. A 20-character password and a 32-character one are both unreachable; the difference is theoretical. What still varies is:

• How the site stored it. A 12-character password behind Argon2 is safer than a 20-character one behind unsalted SHA-1. You have no control over this and no way to know, which is an argument for length as insurance.
• Whether you reused it. A 32-character password used on two sites is weaker in practice than two different 12-character ones.
• Whether you can be phished. Length is irrelevant to a fake login page. That is what two-factor authentication and passkeys are for.

Practical answers by account type

• Email and banking: 16+ random characters, or 6+ random words if you type it. Plus two-factor authentication, without exception.
• Your master password: 6 random words. It has to be memorable and it protects everything else.
• Ordinary accounts: 16 random characters, generated and handled by software.
• Systems that cap you below 12: use the maximum they allow, enable two-factor, and accept that the password is not carrying the account.
• PINs: a different problem entirely. Four digits is only 10,000 combinations, so security comes from lockouts and from not picking a date.

In short

Twelve characters is the floor, sixteen is the answer, and both figures assume randomness. Complexity rules are largely theatre; length is arithmetic. Generate rather than invent (here is the generator), and put the memory effort into the one master password that has to live in your head.