How to Choose the Right Password Length

Length is the single biggest factor in password strength. An 8-character password can fall to a modern offline attack in hours; a 16-character one can hold out for centuries under the same attack, even with a smaller character set.

We recommend a minimum of 12 characters for everyday accounts, and 16 or more for anything sensitive — email, banking, or your password manager's master password. Each extra character multiplies the number of possible combinations, which is why length beats cleverness.

Use the length slider on our Password Generator to dial in the right size, and check the entropy readout under the generate button — it estimates how long a password would take to crack.