Short answer: for an account protected only by a password, aim for at least 15 characters. If you use a password manager, make the password a random 16 or more. If you have to memorize it, use a passphrase of four to six unrelated words. Eight characters is the absolute floor, and it only makes sense when a second sign-in step such as an authenticator app backs it up.
The rest of this article explains why length matters more than anything else about a password, where those numbers come from, and what to do in situations where the simple rule doesn’t apply.
What the official guidance says
The most widely referenced recommendations come from the U.S. National Institute of Standards and Technology (NIST). Its Digital Identity Guidelines (SP 800-63B, Revision 4) set different minimums depending on how the password is used:
| Situation | Minimum length |
|---|---|
| Password is the only sign-in factor | 15 characters |
| Password is one part of multi-factor authentication | 8 characters |
NIST also says services should allow passwords of at least 64 characters, and should not force people to mix uppercase letters, numbers, and symbols, or to change passwords on a schedule.
These rules are written for the organizations that run sign-in systems, but they work well as personal benchmarks. When a site lets you pick a password and nothing else protects the account, 15 characters is a sensible target.
Why length beats complexity
A password is attacked by guessing. An attacker, or software working for them, tries enormous numbers of candidates until one works. Your defense is making the list of possible passwords so large that guessing it is impractical.
Each extra character multiplies that list. If a password is truly random and uses the roughly 95 printable characters on a standard keyboard, the number of possibilities looks like this:
| Length | Possible combinations (approx.) |
|---|---|
| 8 characters | 6.6 quadrillion (6.6 × 10¹⁵) |
| 12 characters | 5.4 × 10²³ |
| 16 characters | 4.4 × 10³¹ |
Going from 8 to 12 characters doesn’t make the list 50% bigger. It makes it about 80 million times bigger. That’s why a longer password is stronger than a shorter one dressed up with symbols.
I haven’t included “time to crack” figures. They depend on the attacker’s hardware and on how the service stores your password, and many published numbers rest on unstated assumptions.
The catch is the word “random.” The table above only holds when every character is chosen unpredictably. Humans aren’t good at this. Summer2026! has 11 characters and ticks every complexity box, but it follows a pattern attackers try early: a common word, a year, and a symbol on the end. Its real strength is far below what its length suggests.
Random passwords vs. passphrases
A password’s strength comes from unpredictability, not length alone. That leaves you two good approaches.
Random character passwords
A string like k7#Vq2!mRx9$tLw4 is hard to guess but hard to remember. This is the right choice for the dozens of accounts you never need to type from memory, as long as something stores them for you (more on that below). A password manager is an app that creates, stores, and fills in passwords so you only remember one.
For these accounts, 16 characters or more is a good default. There’s no real cost to going longer, since you’ll never type it.
Passphrases
A passphrase is several words strung together, such as lantern-gravel-ocean-tulip-brisk. It’s long enough to be strong and easy enough to remember. It only works if the words are chosen randomly, not picked to form a sentence or a meaningful phrase.
One well-known method (Diceware) picks each word at random from a list of 7,776 words. Each word adds roughly 12.9 bits of strength, so:
- 4 words ≈ 52 bits, roughly comparable to a random 8-character password
- 5 words ≈ 65 bits
- 6 words ≈ 78 bits, comparable to a random 12-character password
That’s why five or six words is a better target than four for anything important, and why a famous quote or song lyric doesn’t count: attackers have those lists too.
Use a passphrase for the few things you must remember: your password manager’s master password, your device login, and your email account if it isn’t protected by a manager.
How long is long enough? A practical guide
| What you’re protecting | Suggested approach |
|---|---|
| Most online accounts | Random password, 16+ characters, stored in a password manager |
| Email, banking, and anything that can reset other accounts | Random 16+ characters or a 5–6 word passphrase, plus multi-factor authentication |
| Password manager master password | Passphrase of 5–6 random words |
| Device unlock you type often | Passphrase or long PIN, depending on what the device supports |
| A site that caps the length | Use the maximum allowed, and consider whether you trust the site |
If a site won’t let you go past 12 or 16 characters, that’s a limit on their end, not a reason to pick something short or predictable. Use the maximum, make it fully random, and don’t reuse it anywhere else.
What length can’t fix
A long password is only one layer. It does nothing about several common ways accounts get taken over:
- Reuse. If you use the same 20-character password on two sites and one is breached, both are exposed. Every account needs its own password.
- Phishing. A fake login page that tricks you into typing your password collects it however long it is.
- Malware. Software that records keystrokes sees every character.
- Weak storage on the site’s end. If a service stores passwords carelessly and is breached, your password can be exposed regardless of strength.
This is why NIST sets a lower length floor when a second factor is present. Multi-factor authentication means proving who you are with something more than the password, such as a code from an app or a hardware key. Turn it on wherever it’s offered, especially for email and financial accounts.
Common mistakes and myths
“Adding a symbol makes a short password strong.” It adds a little, but predictable substitutions (a to @, o to 0) are well known to attackers. Another character or two of real randomness does more.
“I need to change my password every few months.” NIST no longer recommends forced periodic changes, because they push people toward small, predictable edits (Winter1, Winter2). Change a password when you have reason to think it was exposed, not on a calendar.
“Longer than 20 characters is overkill.” For a human-typed password, probably. For a random one stored in a manager, it costs you nothing. The real danger is a long password that isn’t random, like a repeated word or a sentence with obvious structure.
“My password is 14 characters, so I’m fine.” Possibly, if it’s random and unique. A 14-character password built from your pet’s name and birth year is weaker than an 8-character random one.
Keeping passwords in a notes file or browser autofill with no master protection. Storage matters as much as strength. Use a dedicated password manager, or at least protect whatever stores your passwords with a strong passphrase.
How to create a strong password in a minute
- Pick the length. Use 16 characters or more for accounts stored in a password manager.
- Make it random. Don’t build it from words, dates, or patterns you chose. A generator removes your habits from the equation.
- Make it unique. One password per account.
- Store it. Save it in your password manager before closing the sign-up page.
- Add a second factor where available.
If you don’t want to invent random strings by hand, the [Random Password Generator](https://[Random Password Generator URL]) can create one for you. Generate a password, check that its length meets the targets above, and paste it straight into your password manager so you never have to remember it.
Frequently asked questions
Is an 8-character password secure?
It meets the absolute minimum in current NIST guidance, but only for passwords used alongside multi-factor authentication. On its own, an 8-character password is short enough that even a truly random one has a much smaller guessing space than a 15 or 16-character one.
Is 12 characters enough?
A random 12-character password is considerably stronger than most people’s real-world passwords, and it’s a reasonable bare-minimum target for lower-stakes accounts. For anything important, or if the password is the only protection, go longer. Some organizations, such as Microsoft, recommend 14 characters as a minimum for their services.
Do I still need numbers and symbols?
Not for the sake of rules. Many sites still require them, so include them when asked. For your own strength, extra length and randomness matter more than character variety.
What’s better: a long password or a passphrase?
They’re two ways of getting the same thing, a large, unpredictable space of possibilities. Random character strings are best when software remembers them for you. Random-word passphrases are best when you have to remember them.
How often should I change my password?
Only when there’s a reason: a breach notification, a suspicious login, or a device you’ve lost. NIST advises against routine forced changes.
Can a password be too long?
For you, rarely. Some systems cap length, in which case use the maximum they allow. NIST’s own guidance says systems should accept at least 64 characters.
The takeaway
Make passwords long, random, and unique. For most accounts that means 16 or more random characters kept in a password manager. For the few you memorize, it means five or six random words. And wherever a second sign-in step is available, turn it on, because even a very strong password is safer with backup.