Security
How long should a password be? The maths behind the advice
How length and character types change the number of possible passwords, how long each would survive a fast offline attack, and what length to choose today.
Length beats complexity
Every extra character multiplies the number of possible passwords by the size of the character set. Adding character types makes the set bigger, but adding length multiplies the effect again and again. A 16-character password of lowercase letters only is far stronger than an 8-character one with every kind of symbol.
This is measured in bits: length × log2(number of possible characters). Each extra bit doubles the work for an attacker.
The table
Assumptions: a random password (not a word with substitutions), an attacker who has stolen a database of fast-hashed passwords and tests 10 billion guesses per second, and success after trying half the possibilities on average.
- Digits only (10 characters): 8 digits ≈ 27 bits, cracked instantly. 16 digits ≈ 53 bits, about 6 days.
- Lowercase (26): 8 letters ≈ 38 bits, about 10 seconds. 12 letters ≈ 56 bits, about 55 days. 16 letters ≈ 75 bits, around 69,000 years.
- Upper + lowercase (52): 8 ≈ 46 bits, about 45 minutes. 12 ≈ 68 bits, around 600 years.
- Letters + digits (62): 8 ≈ 48 bits, about 3 hours. 12 ≈ 71 bits, around 5,000 years.
- Letters, digits and symbols (87): 8 ≈ 51 bits, about 2 days. 12 ≈ 77 bits, around 300,000 years. 16 ≈ 103 bits, beyond any practical attack.
We calculated these figures ourselves from the formula above. Real attacks are often slower, because well-run services use slow hashing, but a worst case is the right thing to plan for.
What to choose
- Accounts in a password manager: 16 or more random characters with all types. You never type them, so length costs nothing.
- Passwords you must type or remember, such as your computer login or the manager’s master password: a passphrase of four to six random words, or at least 12 random characters.
- Wi-Fi: 12 to 16 random characters, and share it with a QR code from QR Code Generator so nobody has to type it.
- PINs: only safe where the device limits the number of attempts, as phones and bank cards do.
Why “random” matters most
The table only holds if every character is chosen at random. Human-made passwords like *Summer2026!* have the right length and types but are among the first guesses attackers try, because they follow patterns: a word, a year, a symbol at the end. Substituting @ for a or 0 for o doesn’t help much either, since cracking tools try those too.
Password Generator picks every character with the browser’s cryptographic random generator and shows the bits and estimated time for the settings you choose. The password is created on your device and isn’t sent anywhere.
More important than length
- Never reuse a password. If one site leaks, attackers try the same email and password everywhere else. A unique password per site limits the damage to one account.
- Turn on two-factor authentication for email, banking and social accounts. It protects you even if a password is phished.
- Change a password when a service reports a breach, not on a fixed schedule; forced regular changes tend to produce weaker, predictable passwords.