By Muhammad Ali Mughal · Last updated 24 October 2026

"At least 8 characters, one uppercase, one number, one symbol." Most of us learned password rules from sign-up forms, and most of those rules are out of date. So how long should a password be? For anything that protects an account on its own, use at least 15 random characters, or a passphrase of 5 or more random words, and let a password manager remember it. Length and randomness matter far more than symbols.

I'm Muhammad Ali Mughal, and I build PixelValut, a set of free privacy and developer tools. In this guide I'll show you the maths behind that answer, the actual numbers I got when I ran it on my machine, and what current guidance from NIST says.

What password entropy means

Entropy is a measure of how many guesses an attacker needs. For a password generated at random, it's simple to calculate:

entropy (bits) = length × log2(size of the character pool)

Each extra bit doubles the number of possible passwords. A random 8-character password drawn from all 94 printable ASCII characters has about 52 bits. A random 16-character one has about 105 bits. That isn't twice as strong. It's 2^52 times as many possibilities.

There's one catch: the formula only holds for random passwords. Summer2026! uses uppercase, lowercase, digits and a symbol, but attackers try season-plus-year patterns early. Its real strength is a tiny fraction of what the formula suggests.

How long should a password be? I ran the numbers

I wrote a short Python script that generates a sample password with the secrets module (Python's cryptographically secure random source) and estimates the average time to crack each format. I assumed an offline attack at 10 billion guesses per second, which is a reasonable figure for a fast, unsalted hash on GPU hardware. Real speeds vary a lot with the hash used, so treat this as a comparison, not a promise.

import math, secrets, string

GUESSES = 1e10  # guesses per second, offline, fast hash

def show(label, pool, length):
    bits = length * math.log2(pool)
    years = 2**bits / 2 / GUESSES / (3600 * 24 * 365)
    print(f"{label:<34} bits={bits:6.1f}  avg crack: {years:.3g} years")

full = string.ascii_letters + string.digits + string.punctuation
print("Sample:", "".join(secrets.choice(full) for _ in range(16)))
for n in (8, 12, 15, 16, 20):
    show(f"Random, all 94 printable, {n}", 94, n)
for w in (4, 5, 6):
    show(f"Passphrase, {w} words (7776 list)", 7776, w)

Here's what it printed (I've rounded the times for readability):

Two things stand out. First, 15 random lowercase letters beat 8 characters that use every symbol on the keyboard. Length wins. Second, a 4-word passphrase is about as weak as an 8-character password, which is why 5 or 6 words is the safer choice.

The 7,776-word list size comes from the EFF dice wordlists, built for picking words at random with dice.

What NIST says about password length

The US National Institute of Standards and Technology updated its digital identity guidelines in SP 800-63B-4. The parts that matter for everyday users and developers:

• Passwords used as the only factor must be at least 15 characters
• Passwords used as part of multi-factor login may be shorter, but at least 8 characters
• Services should allow a maximum length of at least 64 characters
• Services shall not force composition rules like "one symbol, one number"
• Services shall not force periodic password changes, only a change when there's evidence of compromise
• Chosen passwords should be checked against a blocklist of common and breached values

So the "8 characters plus a symbol" rule you see on many sign-up forms falls well short of current guidance.

Password length by use case

A note on PINs: 6 digits is almost nothing offline, but a phone that locks after a few wrong guesses changes the maths. In the same script, a 6-digit PIN limited to 10 guesses per hour takes an average of 5.7 years. Short secrets are only acceptable when guessing is throttled.

How to create a strong password in 3 steps

1. Don't invent it. Humans pick patterns. Use a generator that draws from a secure random source.
2. Pick length over complexity. Set the generator to 16 or more characters, or 5 or 6 words for anything you need to remember.
3. Store it in a password manager, and use a different password for every site so one breach doesn't expose the rest.

If you want a quick generator, the free PixelValut password generator creates random passwords, passphrases and PINs in your browser using crypto.getRandomValues, shows the entropy in bits, and clears your clipboard 30 seconds after copying. Generation happens locally, so the password isn't sent to a server.

For developers: store passwords properly

Length only protects users if your app stores the result well. Hash with a slow, salted algorithm such as Argon2id or bcrypt, as the OWASP Password Storage Cheat Sheet recommends, so the 10-billion-guesses-per-second figure above drops sharply. Accept long passwords and pasted passwords, and check new ones against a breached-password list.

If you look after a domain as well as logins, my guides on checking an SSL certificate and checking SPF, DKIM and DMARC records cover the other two security checks I run on every site.

Strong password checklist

• 15+ characters for any password that works without 2FA
• Randomly generated, not based on words, names or dates
• 5 to 6 random words if you must memorise it
• Unique for every account
• Saved in a password manager
• Two-factor authentication turned on where available

FAQ

How long should a password be in 2026?

Use at least 15 random characters for any account protected by a password alone, which matches NIST SP 800-63B-4. With two-factor authentication the minimum drops to 8, but I still use 16 or more for anything stored in a password manager, because there's no extra effort once the manager remembers it.

Is a 12-character password long enough?

A truly random 12-character password from the full keyboard has about 79 bits of entropy, which is strong against offline guessing. The problem is that most 12-character passwords people choose aren't random. If you're creating one by hand, go longer, or use a generator and a password manager instead.

Are passphrases better than passwords?

A passphrase of 5 or 6 random words is easier to type and remember than a random string of similar strength. The words must be picked at random from a large list, not chosen by you. A 4-word passphrase is too weak by my numbers, so treat 5 words as the minimum.

Do special characters make a password stronger?

They help a little by enlarging the character pool, but length helps far more. In my test, 15 random lowercase letters had more entropy than 8 characters using every symbol. NIST now tells services not to require symbols at all, because forced rules lead to predictable patterns like a capital first letter.

How often should I change my password?

Only when there's a reason, such as a breach notice, a leaked password or a shared account losing a member. NIST SP 800-63B-4 says services shall not force periodic changes. Routine resets push people toward small, predictable edits, which makes passwords weaker rather than stronger.

Generate one now

Pick an account that still uses an old, short password and replace it with a 16-character random one from the password generator. You can also find PixelValut on Google.

What's the longest password a website has rejected for you? Tell me in the comments.

security #passwords #cybersecurity #privacy #infosec #webdev