How long should a password be?

For a random password kept in a password manager, 16 characters. For one you remember, five or six random words. Here is why.

The answer

Random password in a password manager: 16 characters or more.
Password used as the only factor: at least 15, the NIST SP 800-63B-4 minimum since 31 July 2025.
Password you type from memory: a passphrase of five or six random words.
Wi-Fi network: 20 or more, because a captured handshake can be attacked offline.
API keys and machine secrets: 32 characters or more.

The numbers

Length	Letters and digits	With symbols
8 characters	3 hours 48 bits	2 days 52 bits
10 characters	1 year 60 bits	39 years 64 bits
12 characters	5,112 years 71 bits	297,918 years 77 bits
14 characters	20 million years 83 bits	2 billion years 90 bits
15 characters	1 billion years 89 bits	196 billion years 97 bits
16 characters	76 billion years 95 bits	17 trillion years 103 bits
20 characters	1 quintillion years 119 bits	978 quintillion years 129 bits
24 characters	over 10²⁵ years 143 bits	over 10²⁸ years 155 bits
32 characters	over 10³⁹ years 191 bits	over 10⁴⁴ years 206 bits

Average time for an offline attack on a stolen database of fast, unsalted hashes at 10 billion guesses per second (half the search space).

Two things stand out. First, each extra character multiplies the work, so length beats every other choice. Second, past about 14 random characters, offline guessing stops being possible at all. Beyond that point, the threats are phishing, malware and reuse, which length does not stop.

Why the length you remember is different

These figures assume the password is random. A password a person composes is not: a 16 character phrase from a song or a name with a year is guessed in a fraction of the time the table suggests. That is why a remembered password should be a passphrase of random words, not a sentence you thought of.

Published 18 October 2026. Last reviewed 18 October 2026.

Questions

Is 12 characters enough?

For a random password, 12 characters with every type has about 77 bits and is beyond offline guessing. NIST now asks for 15 when the password is the only factor, so 16 is a better default.

Is a longer password always better?

Only if it is random. Length helps when each character is unpredictable. Repeating a word or adding a pattern adds length without adding much strength.

Sources

SP 800-63B-4, section 3.1.1.2: Password Verifiers, National Institute of Standards and Technology. Checked 18 October 2026.

Related tools and guides

16 charactersAbout 103 bits with every character type.15 charactersAbout 97 bits with every character type.NIST password rules (2025)What SP 800-63B-4 changed and what it means for you.Passphrase generatorRandom words you can remember and type.