Password Length vs Complexity

The question every security policy gets wrong

Most password policies mandate complexity — upper and lower case, digits, symbols, minimum 8 characters — and then wonder why users write them down or choose "P@ssw0rd". The underlying assumption is that complexity is what makes a password secure. The research says something different: length matters more than complexity, and mandatory complexity without length requirements tends to push people toward predictable patterns.

Why length multiplies security exponentially

Each additional character multiplies the size of the password space by the size of the character set. Add one character to a password using 95 possible characters, and the number of combinations increases by a factor of 95. Increase the length from 8 to 16 characters and the number of combinations grows by 95⁸ — a factor of about 6.6 quadrillion. This is why a 16-character lowercase-only random password (26¹⁶ ≈ 4.4 × 10²²) is harder to crack than an 8-character password with all character types (95⁸ ≈ 6.6 × 10¹⁵). Length wins by a massive margin.

Why complexity rules backfire

When a site forces users to include a symbol, digit, and uppercase letter, users add the minimum required: they capitalize the first letter, add a "1" at the end, and change the "o" to "0". The result is predictable — and predictable is exactly what dictionary attacks exploit. NIST notes that users respond to composition rules in very predictable ways, which makes the resulting passwords easier to guess than the rules suggest. The policy created predictability instead of preventing it.

What NIST SP 800-63B says

NIST revised its guidelines (SP 800-63B, Revision 4, finalised in 2025) after years of research on how people actually choose passwords. The current requirements prohibit composition rules (such as mandatory character-type mixtures) and mandatory periodic password changes, and recommend that services accept passwords of at least 64 characters. The positive requirements: a minimum length of 15 characters when a password is the only authentication factor (8 characters when it is used only as part of multi-factor authentication), and screening of chosen passwords against blocklists of breached and commonly used passwords. NIST's reasoning is that length and blocklist screening protect users better than composition rules, which mostly add frustration.

The optimal combination

Length and character diversity both contribute to entropy, and you want both — but the order of importance is clear. A 20-character lowercase password has 26²⁰ ≈ 2.0 × 10²⁸ combinations. Adding all character types to a 20-character password gives 95²⁰ ≈ 3.6 × 10³⁹ combinations — a substantial improvement, but only because the length was already adequate. The optimal password: maximum feasible length (16–20 characters), with all character types enabled in the generator. This gives approximately 105–131 bits of entropy — well beyond any practical attack.

How to apply this in practice

For passwords you generate and store in a password manager: use a generator set to 16–20 characters with all character types. For your password manager master password or other credentials you must type: use a diceware passphrase of 7–8 words, which comes close to the entropy of a 16-character random password (about 90–103 bits versus 105) while being typeable. Ignore complexity meters that grade your password by character diversity alone — a 20-character lowercase random string is far stronger than a 10-character string mixing all types, regardless of what the meter says. Meters that measure length are more useful than meters that measure complexity.

What cracking speed means for length

To see why length dominates, assume an illustrative offline attacker making 10 billion guesses per second — a plausible order of magnitude against a fast, unsalted hash on GPU hardware, though real rates vary enormously with the hashing algorithm. An 8-character random password using all 95 printable characters (95⁸ ≈ 6.6 × 10¹⁵ combinations) would be exhausted in about eight days at worst. A 16-character random password using only lowercase letters (26¹⁶ ≈ 4.4 × 10²²) would take around 140,000 years. The 16-character password with all character types (95¹⁶) would take many orders of magnitude longer still. Slow hashing algorithms such as bcrypt and Argon2 reduce the attacker's speed dramatically, but the ratio between the passwords stays the same: length is what moves the needle.

When complexity rules still matter to you

Even though NIST discourages composition rules, plenty of sites still enforce them, and a few cap password length at a low number. If a site demands a symbol or digit, a generator handles it effortlessly: enable all character types, and the requirement is satisfied by a password that is random rather than patterned. If a site caps length, use the maximum it allows with all character types enabled to recover as much entropy as possible, and consider whether a passkey or another sign-in method is available instead. The goal is not to avoid complexity, but to treat it as a bonus on top of length rather than a substitute for it.