How long should a password be?

Short answer: at least 15 characters for anything that matters, 20 random characters when a password manager stores it, and a passphrase of 6 random words when you have to remember it. The old "8 characters with an uppercase letter, a digit and a symbol" rule is obsolete. The reasoning behind those numbers fits in one formula, and once you have seen it you can judge any password policy yourself.

The math: entropy is just counting

A password of length L, with every character picked at random from a set of N symbols, is one of N^L equally likely possibilities. Its strength in bits is:

entropy = log2(N^L) = L × log2(N)

Every extra bit doubles the attacker's work. The 94 printable ASCII characters (letters, digits and punctuation, space excluded) give log2(94) ≈ 6.55 bits per character. Lowercase alone gives log2(26) ≈ 4.70. Notice where the variables sit: the character set is inside a logarithm, the length is a multiplier. That is the whole "length vs complexity" debate settled in one line.

The formula comes with a condition people skip: it only holds when the characters were chosen randomly and independently. Summer2024! is 11 characters drawn from a 94-symbol set, but nobody chose it at random, and an attacker's first million guesses are full of word-plus-year-plus-symbol patterns. Entropy describes how a password was generated, not how it looks.

Password length vs complexity, in numbers

Read it diagonally: 16 random lowercase letters (75.2 bits) beat 8 characters using the full keyboard (52.4 bits) by more than 20 bits, which is a factor of several million. Going from 8 to 12 characters of the same set adds as much as switching from lowercase to full ASCII at length 16.

Who is guessing, and how fast

Bits only become meaningful next to a guessing rate, and the rate depends entirely on the attack.

Online attacks go through the real login form. Rate limits, lockouts and CAPTCHAs cap them at maybe thousands of attempts in total. Brute force is hopeless here; what works is credential stuffing, replaying passwords leaked from another site. No amount of length protects a password you reused.

Offline attacks happen after a breach, when the attacker has the stored password hashes and can guess on their own hardware with no limits. Against an unsalted fast hash such as MD5, a multi-GPU rig manages on the order of 10¹² guesses per second. Against a properly tuned slow hash (bcrypt, scrypt, Argon2) the rate drops to thousands. You never get to choose how a website stores your password, so plan for the bad case.

Average time to find a randomly generated password at an assumed 10¹² guesses per second (on average the search ends halfway through the space):

Treat these as orders of magnitude. Hardware gets faster, and a slow hash shifts every row by a factor of millions in your favour. The ranking between rows is what stays true.

Why P@ssw0rd fails every real test

Swapping a for @ and o for 0 is so common that cracking tools apply it automatically. Tools like Hashcat take wordlists of dictionary words and previously leaked passwords and run rule sets over them: leetspeak substitutions, capitalised first letter, digits and a symbol appended. P@ssw0rd satisfies the classic "upper, lower, digit, symbol" policy and still falls within seconds of a dictionary-plus-rules attack. Its nominal 52 bits are irrelevant because it was never random.

Each substitution costs you effort to remember and costs the attacker almost nothing, since they simply try both spellings. One more random character, by contrast, multiplies their work by the size of the whole character set.

Passphrase vs password

A passphrase in the diceware sense is several words drawn at random from a fixed list. The math is identical, except the "alphabet" is the word list: each word contributes log2(list size) bits. The EFF long wordlist has 7,776 words (five dice rolls per word), giving 12.92 bits per word.

Per bit, a passphrase is longer to type but far easier to remember and to enter on a phone or TV remote. A random password is shorter and ideal when software fills it in. Neither is "stronger" in principle; strength comes from the bit count, and the right choice depends on whether a human has to carry it in their head.

The catch: the word list size matters, and a filtered list gives fewer bits. The Utiliobox password generator uses the EFF long list filtered to words of 3 to 9 letters without hyphens. That leaves 7,772 words, and the tool computes entropy from those 7,772 rather than the original 7,776, which still rounds to 12.92 bits per word. An example of its output style is velvet-tavern-pumice-outfit-grazing-anchor. A phrase you invent yourself, like a song lyric, has a tiny fraction of that entropy, because language is predictable and attackers use phrase dictionaries too.

What NIST SP 800-63B actually requires

NIST's Digital Identity Guidelines are written for US federal systems but are widely used as the baseline elsewhere. Revision 4 of SP 800-63B, finalised in August 2025, says verifiers:

• shall require at least 15 characters when the password is the only authentication factor, and at least 8 when it is used as part of multi-factor authentication;
• should allow passwords of at least 64 characters;
• shall not impose composition rules such as requiring mixtures of character types;
• shall not require periodic password changes, but shall force a change when there is evidence of compromise;
• shall check new passwords against a blocklist of breached, common or context-specific values;
• shall not offer password hints or knowledge-based "security questions".

The rationale matches the math above. Composition rules and forced rotation produce Summer2024! followed by Autumn2024!; minimum length and blocklists actually raise the cost of guessing.

Password managers make long passwords free

Nobody can memorise a unique 20-character random string for every account, and you should not try. A password manager (your browser's built-in one, Bitwarden, 1Password, KeePassXC and so on) generates, stores and fills them. That gives you the property that actually defeats credential stuffing: every site has a different password, so one breach stays one breach. The only secret you still memorise is the master password, which is exactly where a long passphrase belongs.

"Random" has to mean cryptographically random

All of the numbers above assume the attacker cannot predict the generator. JavaScript's Math.random() does not meet that bar. It is built for speed in games and simulations; V8, the engine in Chrome and Node.js, uses xorshift128+, and its internal state can be recovered from a handful of outputs, after which every "random" password it produced can be reproduced. Password generation needs crypto.getRandomValues(), which draws from the operating system's cryptographically secure generator. The Utiliobox generator uses only that API, and if a browser does not provide it, the tool shows a warning and refuses to generate rather than falling back to something weaker.

The modulo bias bug

Even with a good random source, the usual way of turning a random number into a character is subtly wrong. Take a random byte (0 to 255) and compute byte % 62 to index an alphanumeric set. Since 256 = 4 × 62 + 8, the first eight characters each have 5 chances in 256 and the rest only 4, so they come up 25% more often. With 32-bit numbers the skew is tiny, but it never fully disappears. The correct fix is rejection sampling: discard any value in the leftover range that does not complete a full cycle, and draw again. The Utiliobox tool does exactly this with 32-bit values.

"At least one of each type" costs a little entropy

Requiring every character class rules some combinations out, so true entropy is slightly below L × log2(N). With the tool's 89-character set (it leaves out quotes and backslashes), 8 characters drop from 51.8 to 50.7 bits and 20 characters from 129.5 to 129.4. The tool counts the valid combinations exactly and enforces the rule by regenerating the whole password, not by placing one character of each type and shuffling, which would over-represent digits.

How long should a password be? Recommendations by use

The PIN is the exception that explains the rule. Six digits are fine because secure hardware locks after a few failures and the PIN cannot be attacked offline. The moment a secret can be guessed without limits, length is the only thing protecting it.