How Long Should Your Password Really Be?

Length beats complexity

For years, the standard advice was "use a mix of uppercase, lowercase, numbers and symbols" — but modern guidance from security bodies like NIST has shifted heavily toward one simpler message: length matters more than complexity. A 16-character password using only lowercase letters is dramatically harder to brute-force than an 8-character password stuffed with symbols, because each additional character multiplies the number of possible combinations, while adding symbol requirements barely moves the needle once length is already short.

Why, in numbers

Every extra character in a password doesn't add to the difficulty — it multiplies it. An 8-character password using 62 possible characters (upper, lower, digits) has about 218 trillion combinations. A 12-character password with the same character set has roughly 3.2 x 10²¹ combinations — not thousands of times harder, but 14 million times harder. That's the real reason length wins: the math is exponential, not additive.

So what's actually "enough"?

• 12-16 characters is a reasonable baseline for most personal accounts today.
• 20+ characters is worth using for anything protecting financial access or your primary email (since your email can usually reset every other password).
• Unique per site, always. Length doesn't help at all if the same password is reused and one site gets breached — that's how most real-world account takeovers actually happen, not brute-force guessing.

Random vs. memorable passphrases

A truly random string like k#8Rt2!qXw9Lm and a random four-word passphrase like correct horse battery staple can offer similar security if the passphrase is long enough and the words are genuinely randomly chosen (not a common phrase). The passphrase is easier to remember; the random string is easier to generate reliably and works better with a password manager, which most security professionals recommend using instead of memorizing passwords at all.

The randomness matters as much as the length

A 16-character password is only as strong as its math suggests if it's actually generated randomly. Passwords based on patterns, keyboard walks, or personal information are far weaker than their length implies, because attackers try likely patterns before pure brute force. Our Password Generator uses your browser's cryptographically secure random number source (the same kind used for encryption keys) rather than a weaker pattern-based generator, so the entropy estimate it shows you reflects real randomness, not just length.