How Long Should a Password Be?
Length is the single most important property of a password. Every character you add multiplies the number of possible combinations — the table below shows what that does to cracking time in practice.
Cracking time by length and character set
| Length | a–z (26) | a–z, A–Z (52) | + 0–9 (62) | + !@#… (95) |
|---|---|---|---|---|
| 6 | instantly | instantly | instantly | instantly |
| 8 | instantly | 27 seconds | 109 seconds | 55 minutes |
| 10 | 71 seconds | 20 hours | 5 days | 346 days |
| 12 | 13 hours | 6 years | 51 years | 8,561 years |
| 14 | 373 days | 16,746 years | 196,494 years | 77M years |
| 16 | 691 years | 45M years | 755M years | 697B years |
| 20 | 316M years | 331T years | 11,161T years | 56,798,667T years |
Average time for an offline attack on a leaked password hash at ~1 trillion (10¹²) guesses per second, assuming randomly chosen characters. Human-chosen passwords fall far faster.
Why length beats complexity
A symbol or a digit makes each position a little harder to guess, but an extra character multiplies the difficulty of the whole password. Twelve simple characters therefore beat eight “complex” ones — and a long password is also easier to remember than a short cryptic one.
Our recommendations
Use at least 12 characters with a full character set for everyday accounts, 16 or more for email and anything holding payment data, and 20+ — or a passphrase of several random words — for a password manager master password. Email deserves the extra care: whoever controls your inbox can reset most of your other passwords.
A service’s minimum is not a recommendation
Many services still accept 6 or 8 characters. That is the floor below which they refuse the password — not a statement that it is safe. As the table shows, an 8-character password falls quickly to an offline attack no matter how many symbols it contains.
Security Guides
How Long Should a Password Be?
How password length affects cracking time — real numbers per length and character set, plus recommendations for accounts, email and master passwords.
The Most Common Password Mistakes
Six password mistakes attackers exploit every day — reuse, personal details, keyboard patterns, l33t substitutions, short passwords and unsafe storage — and what to do instead.
Two-Factor Authentication (2FA): What It Is and Why It Matters
How two-factor authentication works, which method to choose — security key, authenticator app or SMS — and which major services support it.
Do You Need a Password Manager?
Why a password manager is the only realistic way to keep a unique, random password for every account — and how to protect the vault itself.
Data Breaches: What Happens to Your Passwords When a Service Is Hacked
Breach, scrape or credential stuffing? What each incident type means for your passwords, documented incidents at major services, and what to do when it happens.