A password should be at least 15 characters when it is the only thing guarding an account, and at least 8 characters when a second factor also protects it — those are the exact minimums in NIST SP 800-63B, the U.S. government's current digital identity standard. Modern guidance prioritizes length over complexity: a long passphrase of ordinary words beats a short cryptic password like "P@ssw0rd!", because every extra character multiplies the guesses an attacker must make. The same standard tells organizations to allow passwords up to at least 64 characters, accept spaces and Unicode, screen new passwords against known-breached lists, drop mandatory upper/lower/number/symbol rules, and stop forcing routine password changes.
That is the summary an AI overview would give you. The rest of this article is what it can't: why length wins mathematically, how far each extra character actually pushes an attacker, a length-by-context cheat sheet you can act on today, and the common "long password" mistakes that quietly undo all of it.
Time to crack grows exponentially with length
Password strength is measured in entropy — the number of guesses an attacker must make. Each character you add doesn't add to that number; it multiplies it. That's why a few extra characters matter more than any complexity rule, and it's the single fact that reshaped every modern guideline.
For a password using only lowercase letters (26 possibilities per position), the number of combinations climbs fast:
- 8 characters: 26⁸ ≈ 208 billion possibilities
- 12 characters: 26¹² ≈ 95 quadrillion possibilities
- 16 characters: 26¹⁶ ≈ 43 sextillion possibilities
- 20 characters: 26²⁰ ≈ 20 octillion possibilities
Each added character multiplies the search space by 26. Adding one more character does far more for you than adding a complexity requirement to a shorter password ever could.
What the standards actually say
Guidance from the major authorities has converged on the same idea — prioritize length, drop forced complexity — but the specifics matter, and they're often misquoted. Here is what each body actually requires.
NIST (the standard everyone else follows)
NIST Special Publication 800-63B is the reference nearly every other policy borrows from. Its current requirements for passwords (which it calls "memorized secrets") are precise:
- Passwords used as a single factor must be a minimum of 15 characters; passwords used as part of multi-factor authentication must be a minimum of 8 characters.
- Systems should permit at least 64 characters — no low maximum length caps.
- Systems should accept all printable ASCII characters, the space character, and Unicode (so spaces, emoji, and non-English characters are allowed).
- Verifiers shall screen new passwords against a blocklist of common and known-breached passwords.
- Systems shall not impose composition rules (no forced mix of character types).
- Systems shall not require periodic password changes — only force a change on evidence of compromise.
This is a major reversal from the era of "8 characters with one uppercase, one number, and one symbol, changed every 90 days." NIST concluded that those rules made passwords weaker in practice, because they nudged people toward predictable patterns.
CISA and other agencies
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) recommends passwords of at least 16 characters in its consumer guidance and, like NIST, stresses that length matters more than complexity. It actively promotes passphrases — memorable strings of random words — as the easiest way to reach that length without sacrificing usability.
Enterprise and research consensus
Enterprise security teams and academic researchers land in the same range. A 14- to 16-character minimum is a common enterprise baseline, and mathematical analysis of entropy and real-world breach data consistently points to 16+ characters as the comfortable target for accounts that matter. The disagreements are about the exact floor, not the direction.
Length by context: a cheat sheet
You don't need the same password strength everywhere. Match the length to how much damage a compromise would do. Use this as your default policy.
| Context | Minimum | Recommended | High-security target |
|---|---|---|---|
| Single-factor password (no MFA) | 15 chars (NIST floor) | 16-20 chars | 20+ random, via a password manager |
| Password + MFA / passkey | 8 chars (NIST floor) | 12-15 chars | 16+ chars |
| Email & password-manager master | 15 chars | 20+ chars | 5-6 word random passphrase |
| Banking, financial, crypto wallet | 15 chars | 16-20 chars | 20+ random + hardware MFA |
| Work / enterprise accounts | 14-15 chars | 16 chars | Per policy, + MFA |
| Everyday accounts (social, shopping) | 12 chars | 12-15 chars | 16 chars, unique per site |
| Low-value / throwaway accounts | 12 chars | 12 chars | Unique, manager-generated |
Two rules override every row in this table: use multi-factor authentication wherever it's offered, and never reuse a password — a 20-character password reused across 50 sites is worthless against credential stuffing the moment one of those sites is breached.
Generate one that meets the target
The simplest way to hit any length in this table is to let a generator do it. The tool below runs entirely in your browser — nothing is sent anywhere — so you can produce a long random password or a memorable passphrase and copy it straight into your password manager.
Why "long and simple" beats "short and complex"
Put two real passwords side by side and the math is stark:
Short + complex — "P@ssw0rd!" (9 characters, mixed case, numbers, symbols)
- Looks strong, follows a dictionary word + predictable substitutions + a symbol.
- A brute-force attack that tries common patterns first cracks it in hours to days.
Long + simple — "correct-horse-battery-staple" (28 characters, lowercase words)
- Four random words strung together, no symbols at all.
- Combinations run into the astronomical; brute force would take longer than the age of the universe.
The long, simple password wins by a margin that isn't close, despite using only lowercase letters. That's the whole argument for length in one comparison.
Why complexity rules backfire
Real password crackers don't try every combination at random — they use dictionaries, apply common substitution rules (@ for a, 0 for o, 1 for l), tack on years and symbols, and check breach corpora. Short "complex" passwords fall to these techniques precisely because their complexity is predictable. The supposed strength of "P@ssw0rd1!" evaporates when the attacker's very first ruleset already includes it.
The passphrase approach
Security researchers increasingly recommend passphrases — several random, unrelated words — as the sweet spot between security and memorability:
- "correct-horse-battery-staple" (28 characters)
- "purple-sunflower-dancing-anchor" (31 characters)
- "coffee-laptop-mountain-running-signal" (37 characters)
These reach real length while staying memorable, avoiding the pain of random strings like "xK9#mP2$vN4&". The one non-negotiable is randomness — the words must be chosen randomly, not lifted from a song lyric or a familiar phrase that a wordlist attack would already contain.
The Diceware method
Diceware generates passphrases you can trust to be random:
- Roll physical dice to pick words from a standardized 7,776-word list.
- Combine 5-6 words into a phrase.
- Optionally add a separator or a number.
A five-word Diceware passphrase delivers roughly 64 bits of entropy — strong against all practical offline attacks — while remaining something a human can actually memorize.
Common "long password" mistakes
Length only helps when it comes with unpredictability and discipline. These are the ways people add characters without adding security.
Predictable padding
Bolting characters onto a weak base doesn't help if the additions are guessable:
- "Password1234" is barely stronger than "Password".
- "Welcome2025!" follows an obvious template.
- "Summer2025" is already on every attacker's seasonal wordlist.
If your padding is random enough to help, it might as well be part of a fully random password.
Sitting exactly at the minimum
Many people create passwords at precisely the required length — exactly 8 characters when 8 is the minimum. Attackers know this and focus there first. Going comfortably above the floor (16 characters where 15 is required) is a cheap, meaningful upgrade.
Reusing even long passwords
A 20-character password reused across dozens of sites is a single breach away from unlocking all of them. Length does nothing against reuse. Every account needs its own password, and a password manager is what makes that practical at scale.
Changing on a calendar instead of on evidence
Forced periodic rotation — the old "change it every 90 days" rule — pushes people toward weak, incremental passwords and offers little real protection. Both NIST and modern practice say to change a password only when there's evidence it was exposed. (More on the reasoning in our guide to how often you should change passwords.)
Implementation checklist
For organizations:
- Set the single-factor minimum to 15 characters; allow 8 where MFA is enforced.
- Support at least 64 characters and remove low maximum-length caps.
- Allow spaces, punctuation, and Unicode in passwords.
- Drop mandatory composition rules and periodic rotation; screen against breached-password lists instead.
- Deploy password strength meters that reward length, and encourage password managers.
For individuals:
- Use 16+ character passwords for anything important; longer for email, banking, and your master password.
- Adopt a password manager so length and uniqueness are automatic.
- Use random-word passphrases for the handful of passwords you must memorize.
- Never reuse a password, turn on multi-factor authentication everywhere, and update credentials that show up in a breach.
Beyond passwords
While length recommendations keep climbing, the industry is also moving past passwords entirely. Passkeys (cryptographic credentials tied to your device), biometrics, and hardware security keys are increasingly available and largely immune to the brute-force and reuse problems that plague passwords. They don't remove the need for strong passwords today, but they point toward a future where password length matters less because the password itself is gone.
Bottom line
Make single-factor passwords at least 15 characters and multi-factor passwords at least 8, and aim for 16-20+ characters on anything you truly care about. Prioritize length over complexity, prefer random-word passphrases for the passwords you memorize, and let a password manager generate long unique strings for everything else. Turn on multi-factor authentication, stop rotating passwords on a schedule, and change them only when a breach gives you a reason. That combination — long, unique, unrotated, plus a second factor — is what modern guidance actually asks for, and it's both stronger and less painful than the complexity-and-rotation rules it replaced.
Need to create passwords that meet these length targets? Try our Secure Password Generator to produce strong passwords and passphrases of any length, processed entirely in your browser.