How long should a password be? The math in plain words

Password rules love symbols: one uppercase letter, one digit, one special character. Attackers care far more about something else: how many possible passwords they would have to try.

Every character multiplies the work

With lowercase and uppercase letters, digits and symbols, the 4Dev generator draws from 88 possible characters. Every extra character multiplies the number of combinations by 88. Adding length grows the search exponentially; adding one symbol to a short password barely helps.

8 characters   88^8  ≈ 3.6 × 10^15  ≈ 52 bits
12 characters  88^12 ≈ 2.2 × 10^23  ≈ 78 bits
16 characters  88^16 ≈ 1.3 × 10^31  ≈ 103 bits

What that means in practice

When a database of password hashes leaks, attackers test guesses offline with graphics cards, billions per second against fast hashes. A random 8-character password can fall within hours or days. At 12 characters it would take tens of thousands of years, and 16 characters is beyond any realistic attack.

Random is the key word

Those numbers hold only for truly random passwords. Summer2024! has 10 characters but is among the first guesses attackers try, because it follows a human pattern. Words, names, dates and keyboard walks are tested long before random strings.

Practical advice

Use at least 12 characters, and 16 or more for email, banking and anything that can reset other accounts. Use a different password for every site, keep them in a password manager and turn on two-factor authentication where you can. If a site rejects symbols, add a few extra characters instead.

Passphrases: long and easy to remember

For the few passwords you have to type or remember, such as your password manager’s master password, a passphrase of random words works well. With the Diceware list of 7,776 words, each word chosen at random adds about 12.9 bits.

5 random words  7776^5 ≈ 2.8 × 10^19  ≈ 64 bits
6 random words  7776^6 ≈ 2.2 × 10^23  ≈ 77 bits

Six random words are about as strong as a random 12-character password and much easier to type. The words must be chosen randomly, by dice or a generator: a quote, a song lyric or a sentence you made up is far weaker than it looks.

Rules that don’t help

NIST guidelines (SP 800-63B) advise against forcing users to change passwords on a schedule and against composition rules such as “one digit and one symbol”. Both push people towards predictable patterns like Password1! and Password2!. Better rules: allow long passwords, allow pasting so password managers work, and check new passwords against lists of passwords exposed in known breaches.

When a site you use is breached

Change that password at once, and anywhere else you reused it. Attackers try leaked email and password pairs on other sites within hours, a technique called credential stuffing. A unique password per site turns one breach into one problem instead of many.

Generate one safely

The 4Dev Password Generator creates passwords in your browser with crypto.getRandomValues, the browser’s cryptographically secure random generator. Choose from 4 to 128 characters and which character groups to include; nothing is sent to a server or stored.

Open the Password Generator