How Long Should a Password Be in 2026?
Short answer: at least 16 characters for a random password, or 5–6 words for a passphrase. Longer for anything an attacker could test offline, like Wi-Fi or an encrypted file. Here’s why, and how to choose for each kind of account.
Why length matters more than complexity
Every character you add multiplies the number of possible passwords. For a random password using letters, numbers and symbols (about 80 possible characters), each extra character multiplies an attacker’s work roughly 80-fold. Adding one symbol to a short password helps far less than adding a few characters.
| Random password length | Approx. entropy | Offline attack at 10 billion guesses/sec |
|---|---|---|
| 8 characters | ≈ 50 bits | Hours to days |
| 12 characters | ≈ 76 bits | Hundreds of thousands of years |
| 16 characters | ≈ 101 bits | Far longer than the age of the universe |
| 20 characters | ≈ 126 bits | Beyond any foreseeable computing power |
These figures assume the password is truly random. A 16-character password made from a phrase like MyDogTommy2026!! is far weaker because it follows human patterns.
What the official guidance says
The US National Institute of Standards and Technology (NIST SP 800-63B) asks services to require at least 8 characters, and at least 15 when a password is the only factor protecting an account, and to allow passwords of at least 64 characters. It also says sites should stop forcing arbitrary complexity rules and routine password changes, and instead block passwords that appear in breach lists. The minimum a site accepts is not the length you should use: it’s a floor.
Recommended length by account
| Account | Recommended | Tool |
|---|---|---|
| Everyday websites and apps | 16+ random characters | Password generator |
| Email, banking, UPI, cloud storage | 20+ random characters + two-factor authentication | Password generator |
| Password manager master password | 6+ random words | Passphrase generator |
| Home Wi-Fi (WPA2/WPA3) | 20–63 random characters | Wi-Fi password generator |
| Phone or banking PIN | 6 digits where allowed | PIN generator |
| Sites that block symbols | 16–20 letters and numbers | No-symbol generator |
Can a password be too long?
Practically, no, except that a few sites still cap length (sometimes at 16 or 20 characters) or silently cut it off. If a long password is rejected, use the maximum the site allows, and consider that a warning sign about the site’s security practices.
Length is not enough on its own
- Uniqueness: a 30-character password reused on ten sites is only as safe as the weakest of those sites.
- Two-factor authentication: protects you when a password is phished. See our 2FA guide.
- Breach history: check old passwords with the breach checker.