What Is a Good Password Length? (2026 Guidance)
The short answer: 16 characters for accounts, 20 or more for anything high-value, and treat 8 as obsolete. Sixteen random characters put a password permanently beyond brute force while fitting every mainstream service; since a password manager does the remembering, the extra length over the old 8-character habit costs you nothing.
What the standards say
NIST SP 800-63B sets a hard minimum of 8 characters for user-chosen passwords, and its updated guidance recommends a minimum of 15 — while requiring that systems accept passwords of at least 64 characters. The direction of every revision has been the same: length matters, forced complexity rules and scheduled rotation do not. The UK’s NCSC reaches the same place from the usability side, recommending three random words precisely because the length it produces beats the short “complex” passwords people invent.
Entropy by length
For a fully random password using uppercase, lowercase, numbers, and symbols (an 88-character pool), here is what each length buys against an offline attacker testing 10 billion guesses per second:
- 8 characters: ~52 bits — about 3 days
- 10 characters: ~65 bits — about 58 years
- 12 characters: ~78 bits — hundreds of thousands of years
- 14 characters: ~90 bits — longer than the age of the universe
- 16 characters: ~103 bits — longer than the age of the universe
- 20 characters: ~129 bits — longer than the age of the universe
- 24 characters: ~155 bits — longer than the age of the universe
- 32 characters: ~207 bits — longer than the age of the universe
- 64 characters: ~413 bits — longer than the age of the universe
The cliff is visible at the top of the list: 8 characters fall in days, 10 in decades, and by 14 the numbers stop meaning anything. Every character multiplies the attacker’s work by 88, which is why length beats every other password property.
Length beats complexity
A 20-character password of letters and numbers only (~119 bits) is stronger than a 12-character password with every symbol on the keyboard (~78 bits). Symbols add about half a bit per character; each added character adds six and a half. If a system rejects symbols, use the alphanumeric generator and add two characters — you come out ahead.
When longer stops helping
Past roughly 128 bits (20 random characters), extra length adds margin you will never need against guessing — the realistic attacks shift entirely to phishing, malware, and breaches at the service, none of which care about length. Longer still makes sense where you control the system: 32 or 64 characters for encryption keys, API secrets, and root credentials. Two practical cautions: some legacy systems silently truncate long passwords (log out and back in to verify), and a password you must type by hand daily should be a passphrase rather than a monster string.
Recommendations by account type
- Everyday accounts (stored in a manager): 16 characters.
- Email, banking, cloud storage, registrar: 20 characters.
- Wi-Fi (WPA2/WPA3): 20 characters — typed once per device.
- Admin credentials, API keys, encryption secrets: 24–64 characters.
- Memorized master password: a 5–6 word passphrase instead of a character count.
- Systems that cap you at 8–10: use the cap, fully random, and treat the account as lower-trust.
However long you go, the two properties that actually decide the outcome are that the password is random — from a generator, not your imagination — and unique to one account. Length turns those two into a guarantee.