Key takeaways
- Length matters more than symbols: every extra random character multiplies the guessing work.
- NIST SP 800-63B now asks services to require at least 15 characters when a password is the only sign-in factor.
- A random 16-character password is far beyond any realistic guessing attack; reuse is the bigger risk.
- Only random passwords get these numbers. A long password made from a pattern or a quote is much weaker.
On this page
The short answer
Use at least 15 characters, generated at random, and a different password for every account. For accounts that matter most (email, banking, your password manager), 16 to 20 random characters cost you nothing if a password manager fills them in.
Length against guessing time
The table assumes the worst realistic case: an attacker has stolen a database of password hashes and tests 10 billion guesses per second offline. Times are the average time to find a randomly generated password (half of all possibilities).
| Password | Strength (bits) | Average time to guess |
|---|---|---|
| 8 lowercase letters | 37.6 | About 10 seconds |
| 8 characters, all keyboard symbols | 52.4 | About 3.5 days |
| 4 random words (Diceware list) | 51.7 | About 2 days |
| 5 random words | 64.6 | About 45 years |
| 12 characters, all keyboard symbols | 78.7 | About 750,000 years |
| 6 random words | 77.5 | About 350,000 years |
| 15 characters, all keyboard symbols | 98.3 | About 600 billion years |
| 16 characters, all keyboard symbols | 104.9 | About 59 trillion years |
Strength in bits is the length multiplied by log2 of the number of possible characters: 26 for lowercase, 94 for every printable keyboard character, 7,776 for each word from a Diceware list. Each extra bit doubles the work.
Why "complex" short passwords lose
Going from 8 lowercase letters to 8 characters with symbols adds about 15 bits. Adding just four more random characters of any kind adds more than that. That is why NIST's guidance, updated in its latest revision, tells services to stop forcing mixtures of upper case, digits and symbols, and to stop forcing regular password changes. Instead they should require length (15 characters for password-only sign-in, 8 when combined with another factor), allow at least 64 characters, and reject passwords found in breach lists.
The catch: the numbers only apply to random passwords
Attackers do not try every combination in order. They start with leaked passwords, dictionary words, names, dates, keyboard walks like qwerty123 and common substitutions like P@ssw0rd. A 16-character password built from a song title and a year can fall in minutes. The table holds only when every character or word is picked at random, which is what a generator is for.
Passphrases or random characters?
- Random characters are the strongest per character. Use them for everything stored in a password manager.
- Random words are easier to type and remember. Use five or six for the few passwords you must type yourself, such as your computer login or the password manager's master password. The UK NCSC's "three random words" advice targets everyday accounts and is easier to remember; more words means more strength.
Make one now
The password generator creates passwords up to 128 characters on your device using the browser's cryptographic random generator, shows the strength in bits, and can avoid look-alike characters such as l, 1, O and 0. Nothing is sent or stored. For background on hashing (how sites should store passwords), try the hash generator, and see our guide to strong passwords for managers and two-factor sign-in.
Sources
Fact-checked against the sources above. We test every tool we mention. Editorial policy.
