How long should a password be?

The question behind the question

“How long should a password be” is really asking how much work an attacker has to do before they guess it. That work has a unit, and the unit is bits of entropy.

A bit of entropy doubles the guessing. Sixty bits means roughly a billion billion possibilities. Ninety bits means that number multiplied by another billion. Talking in bits is useful precisely because it collapses length and character variety into one number you can compare.

What each character buys you

For a randomly generated password, entropy is the length multiplied by the bits each character contributes, and each character contributes the base-two logarithm of how many characters were possible.

• Lowercase only, 26 options: about 4.7 bits per character
• Lowercase and uppercase, 52 options: about 5.7
• Letters and digits, 62 options: about 5.95
• Letters, digits, and punctuation, around 90 options: about 6.5

So sixteen characters drawn from letters alone is roughly 75 bits. Sixteen from the full set is about 104. Twenty from letters alone is about 94, which beats the sixteen-character password with symbols in it.

That is the whole argument for length over variety, in one comparison. Adding four characters did more than adding two entire character classes.

Rough targets

• Below 40 bits: guessable by anyone who wants to. Fine for nothing that matters.
• 60 bits: reasonable for a low-value account that has rate limiting.
• 90 bits: strong. A sensible default for anything you would be annoyed to lose.
• 128 bits and above: comfortable for a password manager’s master password, or anything protecting other secrets.

In practical terms, twenty random characters from a mixed set lands around 130 bits, which is why that is a good default rather than a paranoid one.

Why this only works for random passwords

Every number above assumes the characters were chosen at random. They collapse the moment a human picks them.

People choose real words, then a capital at the front, then a digit and an exclamation mark at the end, because that is what the rules asked for. Attackers know this, and their guessing follows those patterns rather than trying every combination. A password that scores well against a strength meter counting character classes can be among the first thousand guesses.

This is why the guidance changed. NIST’s digital identity guidelines explicitly advise against imposing composition rules such as requiring mixtures of character types, and against forcing periodic password changes. Both push people toward predictable choices. The same document tells verifiers to permit passwords up to at least 64 characters, which is the length end of the same argument.

Where the attacker actually is

The numbers above assume the attacker is guessing offline: they have stolen a database of hashed passwords and can try billions of candidates a second on their own hardware. That is the scenario worth planning for, because it is the one where your password is the only thing standing in the way.

Online guessing, where someone types attempts into a login form, is a far weaker attack. Rate limiting, lockouts, and detection make even a mediocre password survive it. This is why advice varies so much: people arguing about whether twelve characters is enough are often silently assuming different attacks.

Plan for the offline case. You do not get to choose how the service you signed up to stores your password, and you usually find out how badly they did it at the same time everyone else does.

There is a second consequence worth stating. Because the offline attack is what matters, reuse is more dangerous than weakness. A strong password used in three places becomes as weak as the worst-run of those three sites the moment one of them is breached, since the attacker will try the recovered password everywhere else. A unique password per site is worth more than extra characters on a shared one.

Passphrases

A passphrase built from several unrelated words is strong for the same reason and by the same maths. If words are drawn at random from a list of 7,776, each word contributes about 12.9 bits. Five words is roughly 64 bits, seven is about 90.

The catch is the same catch. The strength lives in how many words could have been chosen, not in how long the phrase looks. A phrase you picked because it is a line you like carries almost none of that, however many words it has.

What to actually do

Use a generator, use a password manager, and stop trying to remember them. The two passwords worth memorising are the one that unlocks the manager and the one for your primary email account, and both should be long random passphrases.

The password generator shows entropy in bits as you change the length and character set, so you can see the trade rather than guess at it. It runs in the page and nothing is transmitted, which matters here more than for most tools: a generator that sends its output somewhere has produced a secret that is already shared.

One last distinction worth keeping straight. Hashing is not encryption and is not a way to protect a password by itself. A hash of a short or common password is found by guessing the input and comparing, which is why real systems store passwords with a purpose-built, deliberately slow algorithm and a per-user salt rather than a bare SHA-256.