8 character password generator
Made on your device. Never sent or stored.
A random 8 character password, generated on your device. Change the character types below; the length stays at 8 unless you move it.
Is 8 characters long enough?
Eight characters is the shortest length most sites still accept, and the minimum NIST SP 800-63B-4 allows when a password is used together with a second factor such as an authenticator app. On its own it is weak: a random 8 character password with every character type falls to a fast offline attack in hours.
When to use it: Use 8 only where a system forces a short limit, such as some older routers, banking PINs with letters, or legacy software. Turn on two-factor authentication wherever you can.
How strong is a 8 character password?
A random 8 character password from letters and digits has 47.6 bits of entropy. With symbols added it has 51.5. Here is how that translates into guessing time for each character set.
| Characters | Pool | Bits | Fast hash | Slow hash |
|---|---|---|---|---|
| Digits only | 10 | 26.6 | under a second | 1 hour |
| Lowercase letters | 26 | 37.6 | 10 seconds | 121 days |
| Letters, both cases | 52 | 45.6 | 45 minutes | 85 years |
| Letters and digits | 62 | 47.6 | 3 hours | 346 years |
| All four types (this site) | 87 | 51.5 | 2 days | 5,200 years |
These figures only hold for random passwords like the ones above. A 8 character password you made up, with words, names or dates, is guessed far sooner. Test one with the strength checker.
Questions
How many combinations does a 8 character password have?
With the 87 characters used here, 87 to the power 8, about 1015. With letters and digits only, 62 to the power 8, about 1014.
Is this password stored anywhere?
No. It is generated in your browser with the Web Crypto API and never sent to a server.
Sources
- SP 800-63B-4, section 3.1.1.2: Password Verifiers, National Institute of Standards and Technology. Checked 18 October 2026.