How Long Should a Password Be?
For a random generated password, 16 characters is a practical default. Longer is stronger if a manager stores it. Site minimums of 8 characters are a floor, not a target.
A practical answer
If a computer picks each character at random, 16 characters is a sensible starting length for almost every account. Go longer when the site allows it and you are not typing the password from a sheet of paper.
Site rules that demand “at least 8 characters” are a minimum so old forms keep working. They are not a recommendation.
Why length matters
Each extra character multiplies the number of possible strings (the character set raised to the power of the length). That is why a longer random password is usually a better upgrade than adding one punctuation mark to a short one. The comparison lives in password length vs complexity.
| Situation | Practical length |
|---|---|
| Stored in a password manager | 16 or more |
| You must type it often (Wi-Fi, local login) | As long as you can type accurately; a passphrase can help |
| Site caps length at 12 or 16 | Use the maximum and a full character set |
There is no honest universal “years to crack” number. It depends on the hash, the attacker’s hardware, and whether the password was reused and already leaked. Treat published countdown tables as marketing unless they state those assumptions.
Generate, then store
The MultiConvers password generator lets you set the length and see an entropy estimate in bits. Copy the result into a manager. Steps for using that password well are in how to create a strong password.
FAQ
- Is 8 characters enough?
It meets many site minimums. For a random password you will store in a manager, it is a weak target. Prefer 16 or more when the site allows it.
- What about a four-word passphrase?
Four uncommon words can be long enough in characters. The words still have to be unpredictable and unique to that account.
Related guides
Password Length vs Complexity
On a random password, adding characters usually beats adding a punctuation rule to a short string. Complexity rules still help when they stop you from using a dictionary word.
How to Create a Strong Password
Use a unique, randomly generated password for each site, store it in a password manager, and prefer length over a clever substitution on a short word.
Related tools
See all guides.