15-Character Password Generator

NIST’s updated SP 800-63B guidance recommends a 15-character minimum for memorized secrets, up from the older 8-character floor. Fifteen random characters with mixed types reach about 96 bits of entropy — effectively uncrackable by brute force — while still fitting within the length limits of virtually every service.

The difference between 15 and 16 characters is marginal: both are far beyond brute-force range. Choose 15 when a site or standard specifies it, or 16+ when you simply want the maximum margin. What matters far more than one character is that the password is fully random and unique to a single account.

Not by brute force. At roughly 96 bits of entropy the keyspace is astronomically large — an attacker testing 10 billion guesses per second would still need far longer than the age of the universe. The realistic risks are password reuse, phishing, and malware, none of which depend on length.

At roughly 96 bits of entropy, brute force is hopeless: an attacker testing 10 billion guesses per second would need far longer than the age of the universe. Any realistic compromise would come from phishing, malware, or reuse — never from guessing.

Yes. NIST SP 800-63B's updated guidance recommends a 15-character minimum for memorized secrets, above the older 8-character floor, so a random 15-character password aligns with current best practice while staying compatible with virtually every service.

It is an excellent default. Use 15 or more for any account that matters, and only go shorter when a site enforces a lower maximum. Store each one in a password manager so length never becomes an inconvenience.