How long should a password be?

Most password advice is a decade out of date. It tells you to use a mixture of upper and lower case, numbers and symbols, and to change it every ninety days. Both of those recommendations have been formally withdrawn by the organisation that popularised them, and the reasoning is worth understanding, because it changes what you should actually do.

The short answer

• 16 characters random, for anything that matters.
• 20 or more for a password manager's master password, your email account, and anything financial.
• Never reuse one across sites. This matters more than length.
• Turn on two-factor authentication where it is offered. It defeats several attacks that no password length can.

If that is all you wanted, Password Generator produces exactly this, generated in your browser and never transmitted. The rest of this explains why.

Why length beats complexity

Password strength is measured in bits of entropy — how many guesses an attacker would need on average. The formula is the size of the character set raised to the length of the password, expressed in bits.

That "raised to the length" is doing enormous work. Adding one character multiplies the number of possibilities by the size of the alphabet. Adding a whole new category of symbol only widens the alphabet slightly. Compare:

• 8 characters, everything — upper, lower, digits, symbols: about 52 bits.
• 12 characters, lowercase only: about 56 bits.
• 16 characters, lowercase only: about 75 bits.
• 16 characters, everything: about 105 bits.

Twelve lowercase letters beat eight characters of maximum complexity. The rule of thumb that follows: if you have to choose between adding a symbol and adding two more characters, add the characters.

What do the bits mean in practice? Under 50 bits is weak against a determined attacker with modern hardware. Around 60–80 is reasonable for ordinary accounts. Above 80 bits, a brute-force attack stops being a realistic threat with any hardware that currently exists — at a trillion guesses per second, 80 bits takes around 38,000 years on average.

The complexity rules were a mistake

The "must contain an uppercase letter, a number and a symbol" convention came from a 2003 NIST guideline. Its author later said publicly that he regretted it. NIST's current guidance (SP 800-63B) recommends the opposite: do not impose composition rules, and do not force periodic changes unless there is evidence of compromise.

The reason is human behaviour. Forced complexity does not produce random passwords — it produces predictable mutations. password becomes Password1!. Forced rotation produces Password1! then Password2!. Attackers know these patterns and their cracking tools apply them automatically, so the rules add almost nothing to real-world strength while making passwords much harder to remember.

Length requirements, by contrast, cannot be gamed the same way. This is why modern guidance is "longer, and different everywhere" rather than "more symbols, more often".

Passphrases, and when to use one

A passphrase is several random words strung together — copper-lantern-drift-ember rather than x7$Kp2#mQ. Four random words from a large list gives roughly 52 bits; five gives about 65; six about 78.

The crucial word is random. Words you chose yourself are not random — they come from a much smaller mental vocabulary and follow grammatical patterns. A quote, a song lyric or a memorable sentence has far less entropy than its length suggests, because attackers use dictionaries built from exactly that kind of text.

Passphrases are worth it where you have to type the password often or read it aloud: a device unlock code, a password manager's master password, a Wi-Fi key. Everywhere else, a random string in a password manager is stronger per character and you never type it anyway. Password Generator does both.

The thing that actually gets people breached

Here is the uncomfortable part: for most people, password length is not what gets them compromised. Reuse is.

The common attack is not brute force against your account. It is credential stuffing — an attacker takes a username and password from a breach of some unrelated site and tries the pair on hundreds of others. If you used the same password anywhere else, the length is irrelevant, because they are not guessing. They already have it.

This is why a password manager matters more than any single password rule. It makes unique passwords per site practical, which is the only defence against stuffing. The one password you must remember and protect is the master password — that is where the 20-plus-character passphrase belongs.

Two-factor authentication is the other half. Even a fully compromised password fails against a second factor, which is why it is worth enabling on email and financial accounts even if it is mildly inconvenient.

A practical checklist

1. Use a password manager. Any reputable one.
2. Give it a long random passphrase as its master password, and write that one down somewhere physically secure.
3. Let it generate 16+ character random passwords for every site.
4. Turn on two-factor authentication on email, banking and anything holding payment details.
5. Stop changing passwords on a schedule. Change them when there is a reason.
6. Check whether your addresses appear in known breaches, and change anything that does.

Generate what you need with Password Generator — it runs entirely in your browser, uses the same cryptographic random source as encryption keys, and shows the calculated entropy so you can see where a password actually sits. If you want to understand hashing rather than passwords, Hash Generator is next door, and everything else is on Pikkit.