For years we were told to use eight characters with a capital letter, a number and a symbol. That advice made passwords hard for people to remember and still fairly easy for computers to guess. Today the consensus is clear: length matters more than complexity.
Why length wins
Every character you add multiplies the number of possible passwords. With all four character types available (about 90 options per character), an 8-character password has roughly 90⁸ possible combinations. A 16-character password has 90¹⁶, which is not twice as many but about 4 quadrillion times as many.
Security people describe this as entropy, measured in bits. Each bit doubles the number of guesses needed.
| Password | Approximate entropy |
|---|---|
| 8 lowercase letters | 38 bits |
| 8 mixed characters | 52 bits |
| 12 mixed characters | 78 bits |
| 16 mixed characters | 104 bits |
So how long?
- 12 characters is a sensible minimum for everyday accounts.
- 16 or more for your email, banking, work accounts and your password manager.
- If you need to type it often, a passphrase of five or six random words is both long and memorable.
The important word is random. A long password built from your name, your city and your birth year is much weaker than its length suggests, because attackers try those patterns first.
Length is not the whole story
Most accounts are not broken by someone guessing a strong password. They are broken because the same password was reused on a site that got breached. Once one password leaks, attackers try it everywhere else.
- Use a different password for every account.
- Store them in a reputable password manager so you only need to remember one.
- Turn on two-factor authentication, especially for email, which is the key to resetting everything else.
Is it safe to use an online generator?
It depends on how it works. A good generator creates passwords on your device using the browser’s cryptographic random number generator and never sends them anywhere. That is how the Pickonic generator works: the password exists only on your screen until you copy it.
What the current guidance actually says
The US National Institute of Standards and Technology publishes digital identity guidelines that many organisations follow. The current version, NIST SP 800-63B, sets out a few rules worth knowing:
- A password used on its own to protect an account should be at least 15 characters.
- A password used as one part of multi-factor authentication can be shorter, but at least 8 characters.
- Services should allow passwords of at least 64 characters.
- Services should not force mixes of character types or regular password changes. A change is required when there is evidence the password has been compromised.
In other words, the official direction has moved away from short, complicated passwords that change every 90 days, and toward long, unique passwords that only change when something goes wrong.
Passphrases: long and memorable
For the few passwords you have to remember, such as your computer login or your password manager, a passphrase works well. Pick four or five random, unrelated words, for example “lantern-orbit-cactus-violin-harbour”. That is over 30 characters, easy to type, and far harder to guess than “P@ssw0rd2026!”.
The key word is random. A line from a song, a famous quote or your children’s names are not random, and attackers try exactly those first. Let a generator pick the words, or roll dice with a word list.
One password per account
Length does not help if you reuse the same password everywhere. When one website is breached, attackers try the leaked email and password combinations on banks, email providers and social networks. This is called credential stuffing, and it works because so many people reuse passwords.
A password manager solves this. It creates a long random password for every account, stores them encrypted and fills them in for you. You only need to remember one strong passphrase to unlock it. Our password manager guide covers how to choose one.
Add a second factor
Even a perfect password can be stolen by a fake login page. Two-factor authentication means a stolen password alone is not enough. Authenticator apps and hardware security keys are stronger than SMS codes, and passkeys go further by removing the password from the login entirely. See our comparison of 2FA methods.
Frequently asked questions
Is a 12-character password enough?
If it is truly random and used with two-factor authentication, it is reasonable. For a password used on its own, current guidance says 15 characters or more.
Should I change my passwords every few months?
Not unless there is a reason, such as a breach or suspicious activity. Forced regular changes tend to produce weaker, predictable passwords.
Are symbols still useful?
They add some strength, but length adds more. A long random password with only letters and numbers beats a short one packed with symbols.
How do I know if my password has leaked?
Many password managers and browsers check your saved passwords against known breaches and warn you. Change any password they flag straight away.