Short answer: use at least 12 random characters for everyday accounts, and 16 or more (or a passphrase of 6 random words) for anything that matters: your email, your password manager and encrypted files. Length only counts if the password is random, though. Summer2026! is 11 characters long and is one of the first things an attacker will try.
Here is where those numbers come from, why "complex" rules matter less than length, and how to make strong passwords without having to remember them.
Why length beats complexity
Password strength is measured in bits of entropy: how many guesses an attacker would need in the worst case. Every random character multiplies the number of possible passwords by the size of the character set. With upper and lower case letters, digits and symbols (91 characters in our generator), each character adds about 6.5 bits. Adding one more random character helps far more than swapping an a for an @.
How long could a determined attacker take to try every possibility? The table assumes 100 billion guesses per second, which is realistic for a stolen database protected by a fast, outdated hash, or for an encrypted file being attacked offline on powerful hardware:
| Password | Entropy | Time to try every combination |
|---|---|---|
| 8 lowercase letters | 38 bits | About 2 seconds |
| 12 lowercase letters | 56 bits | About 11 days |
| 8 random characters (all types) | 52 bits | About 13 hours |
| 12 random characters (all types) | 78 bits | About 100,000 years |
| 16 random characters (all types) | 104 bits | Trillions of years |
| 4 random words | 52 bits | About 10 hours |
| 5 random words | 65 bits | About 9 years |
| 6 random words | 78 bits | About 70,000 years |
The passphrase rows assume words picked at random from a list of 7,776 words, the size of the well-known Diceware lists. Websites with sensible protections, such as slow password hashing and login rate limits, are attacked far more slowly than this, so these figures are the worst case.
What official guidance says
The US National Institute of Standards and Technology (NIST) publishes the guidelines many organisations follow (SP 800-63B). The current version:
- requires passwords used on their own to be at least 15 characters long, and at least 8 when combined with a second factor;
- tells services to allow long passwords, at least 64 characters, including spaces;
- drops forced composition rules such as "must contain a symbol";
- drops routine expiry: you should only have to change a password when there's evidence it has been compromised;
- asks services to reject passwords that appear in lists of breached, common or expected passwords.
Random characters or passphrases?
Both are strong if they are truly random. Choose by how you'll use the password:
- Random characters pack the most strength into the fewest characters. They are ideal when a password manager fills them in for you.
- Passphrases such as Velvet-Canyon-Pickle-Orbit-Lantern are much easier to type on a TV remote or a phone keyboard and to remember. Use at least 5 random words, ideally 6, for important accounts.
The key word is random. A line from a song, a famous quote or words you chose yourself are far weaker than the table suggests, because attackers try those first.
Mistakes that make long passwords weak
- Reusing a password. When one site leaks, attackers try the same email and password everywhere else. Every account needs its own password.
- Predictable patterns. A capital first letter, a year and an exclamation mark at the end is the most common pattern of all.
- Obvious substitutions. P@ssw0rd is in every cracking dictionary.
- Personal details. Names, birthdays, pets and football teams are easy to find on social media.
How to manage dozens of unique passwords
Nobody can remember 80 random passwords, and you don't need to. A password manager (built into your browser or phone, or a dedicated app) generates, stores and fills them for you. You only memorise one strong master passphrase of 6 or more random words.
For your most important accounts, add a second layer: two-factor authentication through an authenticator app, a security key or passkeys. Passkeys replace the password entirely with a cryptographic key stored on your device, which also makes them resistant to phishing.
Generate a strong password
Our Free Password Generator creates passwords from 4 to 128 characters with your choice of upper and lower case letters, numbers and symbols, and can leave out look-alike characters such as l, I, O and 0. It also makes passphrases of 3 to 15 words, drawn from a built-in list of about 2,300 common words (roughly 11 bits per word, so choose 6 words for important accounts), as well as numeric PINs. Each result shows its strength in bits, calculated from how it was generated rather than from its length. Everything is generated in your browser using its cryptographically secure random number generator, so passwords are never sent anywhere.
If you are protecting a document, our guide on password protecting a PDF explains why files need especially strong passwords: they can be attacked offline without any lockout.
Frequently asked questions
Is an 8-character password enough?
Not on its own. Even a fully random 8-character password can be exhausted in hours by an offline attacker. Use 12 or more characters, and turn on two-factor authentication where you can.
Is a 4-word passphrase secure?
Four random words (about 52 bits) is fine for a low-value account on a well-protected site, but for anything important use 5 or 6 words.
How often should I change my passwords?
Only when there's a reason: a data breach, a sign that someone else has used the account, or after sharing the password. Regular forced changes tend to produce weaker, predictable passwords.
Are online password generators safe?
They're safe if the password is generated on your device and never transmitted. The Quickaboo generator runs entirely in your browser; you can even disconnect from the internet after the page loads and it keeps working.