How Long Should a Password Be?

Why length matters more than anything else

Every additional character in a password does not just add one more possibility — it multiplies the total number of combinations exponentially. An eight-character password using all four character types (uppercase, lowercase, numbers, symbols) has roughly 6.6 quadrillion possible combinations. Modern password-cracking hardware can test billions of combinations per second against fast hash algorithms. Against fast, unsalted hash algorithms, that eight-character password can fall within hours.

Increase the length to sixteen characters with the same character set, and the number of combinations grows to 4.4 × 10³¹ — a number so astronomically large that even at hundreds of billions of guesses per second it would take far longer than the age of the universe to crack it through brute force. Length is leverage.

The eight-character myth

For most of the 2000s and early 2010s, eight characters was considered a reasonable minimum. Security guidelines from that era recommended eight characters plus a mix of character types, and many websites still enforce it as their minimum. The problem is that hardware has advanced enormously: consumer GPUs can now test hundreds of billions of guesses per second against fast hash algorithms, and rented multi-GPU rigs are inexpensive. Eight characters is no longer a safe minimum — it is a liability.

Hive Systems, which publishes an annual password-cracking time table, models the effect of GPU hardware on cracking times and notes that crack times have been falling year over year. How a site stores passwords matters enormously: against a slow hash such as bcrypt, even short passwords hold out for a long time, but against fast, unsalted hashes like MD5 or NTLM an eight-character password falls within hours. Length is the lever you control.

What the NIST guidelines say in 2026

The US National Institute of Standards and Technology (NIST) publishes the most widely adopted password security standards in the world. Their current guidelines, NIST SP 800-63B, made a fundamental shift from complexity to length. Key recommendations: minimum 15 characters when a password is the only authentication factor, minimum 8 characters when it is combined with multi-factor authentication, and a maximum of at least 64 characters to support passphrases. NIST also explicitly retired mandatory periodic password changes, complexity requirements (forced use of symbols), and knowledge-based authentication questions.

The shift reflects what security research has confirmed: a long, random password beats a short, complex one every time. A 20-character lowercase-only random string is more secure than an 8-character password with every possible character type.

Minimum lengths by account type

Not all accounts carry the same risk. Here are practical minimums for 2026.

Email accounts: 20 characters minimum. Your email is the master key to every other account — it is used for password resets across the internet. A breach of your email account cascades to every site linked to it. This warrants the longest password you use.

Banking and financial: 16–20 characters. Financial accounts have direct monetary consequence. Some banks cap password length, so use the longest password they allow.

Password manager master password: 20+ characters. This single password protects every other credential you have. It should be the strongest password you create — consider a diceware passphrase of six or more words.

Social media: 16 characters minimum. Social accounts are high-value targets for impersonation and can be used to access linked services.

Shopping and general accounts: 14–16 characters. Lower value targets, but still warrant a unique, sufficiently long password.

Passphrases as an alternative to random strings

A passphrase — several random words strung together — can meet length requirements while remaining memorable. "correct horse battery staple" (from the famous xkcd comic) is 28 characters of lowercase letters and spaces, which is easy to type and remember — though that specific four-word example is now famous and should never be used. Entropy depends on the number of random words, not the character count: four words from a 7,776-word diceware list give about 51 bits, six words about 77 bits. The requirement is that the words must be genuinely random, not a phrase that means something to you. Use a diceware word list and real dice, or a trusted passphrase generator.

For accounts stored in a password manager (which should be all of them except the master password), there is no reason to use passphrases — a generator creates and stores random passwords automatically. Passphrases serve the specific case of passwords you must memorise.

The practical rule for 2026

Use a minimum of 16 characters for every account, 20 for critical accounts (email, banking, password manager). Use a password generator set to at least 16 characters with all character types enabled. Store everything in a password manager so the length never becomes an obstacle to remembering. Review your existing passwords and upgrade any that fall below 12 characters — short passwords are the easiest for current cracking hardware to attack, especially if the site stores them with a weak hash.