Password Generator · Practical guide
How Long Should My Password Be?
Twelve characters is the modern minimum — sixteen or more is better. Check the strength of any length instantly.
At a glance
The Short Answer: 12 to 16 Characters
Your password should be at least 12 characters long, and 16 or more for banking, email, and other sensitive accounts. A random 12-character password using uppercase, lowercase, numbers, and symbols has about 78.7 bits of entropy — roughly 150,000 years to crack by offline brute force at 100 billion guesses per second. At 16 characters, that climbs to 104.9 bits and trillions of years.
Interactive tool
Password Generator
Enter your own values, then compare the result with the examples below.
Generated Password
Crack Time by Password Length
These estimates assume all four character types (a 94-character pool) and the offline attack speed used by the generator above:
| Length | Entropy | Offline Crack Time | Rating |
|---|---|---|---|
| 8 characters | 52.4 bits | ~17 hours | Fair |
| 10 characters | 65.5 bits | ~17 years | Good |
| 12 characters | 78.7 bits | ~150,000 years | Good |
| 16 characters | 104.9 bits | Trillions of years | Strong |
| 20 characters | 131.1 bits | Trillions of years | Strong |
Why Length Beats Complexity
Every extra character from the full 94-character pool adds about 6.55 bits of entropy and multiplies the search space by 94. Adding four characters makes a password about 78 million times harder to brute-force — far more than swapping an "a" for an "@". Aim for a rating of Strong, which starts at 80 bits; anything under 40 bits is considered weak.
Frequently Asked Questions
Is an 8 character password still safe?
Not really. An 8-character password with all character types has about 52 bits of entropy and could fall to an offline brute-force attack in hours. Use 12 characters minimum.
How is the crack time calculated?
The estimate assumes 10 billion guesses per second for online attacks and 100 billion per second for offline attacks, searching the entire space of possible passwords.
Is a long passphrase better than a short complex password?
Yes, if it is random. Length adds entropy faster than symbol tricks, and a longer password is also easier to type correctly.
Should I use a different password for every account?
Yes. Length protects you from brute force, but reuse is what turns one data breach into many compromised accounts. Generate a unique password per account.