Password security guide
How Long Should a Password Be?
For generated account passwords, 16 to 20 characters is a practical default when accepted. Length must be combined with randomness, uniqueness and safe storage.
Recommended password length by situation
| Situation | Practical approach |
|---|---|
| Ordinary account stored in a manager | Random 16 to 20 characters if accepted |
| High-value administrator or primary email | Random 20 or more characters plus phishing-resistant MFA |
| Vault master credential you must remember | Five to seven independently selected random words, subject to provider guidance |
| PIN protected by strict retry limits | Use the longest random PIN the system supports |
These are practical recommendations, not universal platform rules. Always follow the target service limits and your organization policy.
Is 12 characters enough?
Twelve random characters can provide a large theoretical search space, especially with a broad pool and online rate limiting. Twelve human-chosen characters can be very weak. Google recommends at least 12 characters for a Google Account, but a manager removes the need to stop there.
Use 12 only where service constraints or typing requirements justify it. Prefer 16 or more for newly generated credentials when the service accepts the value.
Why 16 to 20 random characters is a useful default
At this length, a uniformly random password from a practical mixed pool has a very large search space while remaining compatible with most modern services. A password manager handles entry, so the user does not pay a memorization cost. Increasing from 16 to 20 characters multiplies the space by the pool size four times.
The calculation assumes independent random selection. It does not apply to a phrase built from names, words and dates.
What does NIST say about password length?
NIST SP 800-63B sets requirements for verifiers. Passwords used as a single authentication factor must have a minimum of 15 characters; passwords used within multi-factor authentication may have a minimum of eight. Verifiers should allow a maximum length of at least 64 characters and accept spaces and Unicode input under defined processing rules.
NIST does not say that every user must choose a specific 64-character password. It also discourages arbitrary periodic changes and composition rules. Services still set their own policy.
Length versus character variety
For uniform generation, both pool size and length increase combinations. Adding one random character multiplies the space by the full pool. Adding a required symbol in a predictable final position does much less for a human pattern.
When a service has a small accepted pool, add length. When it requires specific groups, satisfy them through random generation. Do not trade uniqueness for a more complicated recipe.
Maximum lengths and silent truncation
Some legacy systems reject or truncate long passwords. Silent truncation is particularly dangerous because two different entered values may authenticate as the same stored prefix. Test a new credential by signing out and back in before deleting the old record or recovery route.
Do not assume the HTML input limit is the full server policy. Use official service documentation where available.
Passphrase word count is a separate question
Character length alone overstates a human sentence. A generated passphrase is measured by independent word choices. With the 7,776-word EFF list, each random word contributes about 12.9 bits before optional choices. Four words and seven words therefore represent very different spaces even if both look long.
Use more words for a vault master credential when usability permits, and never count a self-written quotation as if it came from uniform dice rolls.
Choose length without false precision
The exact time to guess a password depends on the attack. A rate-limited online login may allow few attempts. Stolen hashes can be tested offline at a rate determined by the hashing algorithm, parameters and hardware. Password reuse bypasses guessing completely.
Choose a comfortable margin, use unique random generation, enable MFA, and focus on secure recovery. The brute-force calculator makes assumptions visible instead of presenting a universal crack-time promise.
Password length for email, banking and administrator accounts
Primary email deserves a generous margin because it resets other accounts. Use a long random password, strong MFA and reviewed recovery details. Financial services may impose stricter character or length rules; use the longest random value they accept and never reuse it. Administrator credentials for hosting, domains, cloud services and content systems should also be unique, long and protected by phishing-resistant MFA where available.
The recommended length is not a substitute for account controls. A 30-character password entered into a convincing phishing site can be stolen, while a 16-character random password combined with a passkey or security key and secure recovery may be much harder to abuse. Choose length as one layer in the system.
How password managers change the length decision
When a manager generates and fills the credential, there is little usability cost in choosing 20 or more characters. The main constraints become service compatibility, mobile-app input bugs and recovery. Record the exact login domain in the vault and test the new credential before closing every authenticated session.
For a master credential, usability is different because you must enter it during recovery and on new devices. A multi-word random passphrase can be easier to reproduce than a long character string. Increase independent word count rather than adding a predictable quote or date.
Password length questions
Is a 32-character password always better?
It has a larger uniform space than a 16-character password from the same pool, but only if both are generated independently. It may add little practical value if the service already uses strong rate limiting and MFA, and it can create compatibility problems on old systems.
Can a password be too long?
A well-designed verifier should accept long input, but real services have limits. Very long manual secrets increase typing and recovery risk. Choose a strong margin the target system handles reliably.
Does changing characters after generation reduce strength?
Predictable editing changes the model. Configure allowed characters before generating so the displayed space matches the result.