How Long Should a Password Be?

There's no single correct password length — the right answer depends on what you're protecting and how it's stored. But there are concrete, defensible targets, based on entropy maths and modern cracking speeds rather than tradition or guesswork.

What the numbers say

Modern GPU-accelerated cracking rigs can attempt many billions of hash guesses per second against weakly-hashed data, and even against strongly-hashed data (bcrypt, Argon2) the cost per guess, while much higher, still favours longer passwords enormously. Because entropy grows exponentially with length, each additional character doesn't just add a bit of safety margin — it multiplies the total search space. That's why length is consistently the single highest-leverage thing you can control.

Concrete targets by account type

• Low-stakes accounts (forums, free trials, throwaway signups): 12 characters minimum, generated
• Everyday accounts (shopping, streaming, most day-to-day logins): 14–16 characters, generated
• Sensitive accounts (email, banking, work accounts): 16–20 characters, generated, with two-factor authentication enabled
• Your password manager's master password: a long passphrase (5+ random words) that you can reliably type from memory, since this one can't live inside the manager itself

Why NIST stopped recommending shorter, "complex" passwords

NIST's SP 800-63B guidelines moved away from short passwords stuffed with mandatory symbols, because that approach reliably produces predictable patterns (Summer2026!) rather than genuine randomness. Their current guidance favours length, supports passphrases explicitly, and recommends systems accept at least 64 characters and screen new passwords against known-breached password lists rather than enforcing arbitrary composition rules.

Is there a point where longer stops mattering?

Practically, once a password crosses roughly 20 random characters, it's already far beyond what any realistic brute-force attack could crack in a meaningful timeframe — at that point, the encryption and hashing scheme protecting the password on the server side becomes the limiting factor, not the password itself. There's no harm in going longer, but the marginal security benefit shrinks fast past that point.

The short version

If you only remember one number, make it 16. That length, generated randomly and never reused, covers the overwhelming majority of real-world accounts with room to spare.