How Long Should a Password Be? Length, Passphrases and Strength
Updated October 22, 2026
Short answer: at least 12 characters for ordinary accounts and 16 or more for important ones, and the best password is a long, random one that you never have to remember.
Why length matters most
Every extra character multiplies the number of guesses an attacker needs. A random password made from letters, numbers and symbols gains about 6.5 bits of strength per character, so each character makes it roughly 94 times harder to guess.
| Password | Strength (bits) | Verdict |
|---|---|---|
| 8 random lowercase letters | About 38 | Weak |
| 8 random characters (all types) | About 52 | Fair, but the minimum |
| 12 random characters (all types) | About 79 | Strong for most accounts |
| 16 random characters (all types) | About 105 | Very strong |
| 4 random words (passphrase) | About 52 | Fair |
| 6 random words (passphrase) | About 77 | Strong and easy to type |
What the experts recommend
- NIST, the US standards body, says length matters more than forced complexity rules, and that sites should allow long passwords (at least 64 characters).
- Use a different password for every account, so one leak does not open the rest.
- Use a password manager to create and store them, and remember just one strong master password.
- Turn on two-factor authentication for email, banking and anything important.
Random password or passphrase?
- A random password (such as the ones the Password Generator makes) is best when a password manager fills it in for you.
- A passphrase of four to six random, unrelated words is best for the few passwords you must type or remember, such as your master password.
- Pick the words randomly. A phrase from a song or a quote is much easier to guess than it looks.
What to avoid
- Names, birthdays, pets, and anything on your social media.
- Common patterns such as Password1!, qwerty or 123456, with a number added at the end.
- Reusing a password with a small change, such as adding the site's name.
- Typing passwords into a tool that sends them to a server. The Password Generator on this site runs in your browser and never sends the password anywhere.
Frequently asked questions
Is a 12-character password long enough?
A random 12-character password using letters, numbers and symbols is strong for most accounts today. For your email, banking and password manager, use 16 or more characters.
Do I need to change passwords regularly?
Not on a schedule. Current advice is to change a password only when you suspect it has been exposed, for example after a data breach, and otherwise to keep a strong, unique one.