How Long Should a Password Be in 2026? (Length Chart + Crack Times)

The short answer: 16 characters minimum for anything that matters, 20+ for accounts you can never afford to lose (email, banking, crypto). This post explains why the number went up, what "strong" actually means in 2026, and gives you a rulebook you can copy-paste.

Why the recommended length keeps rising

Password strength is measured in entropy — the number of guesses an attacker needs to make on average. Every added character multiplies the search space. What changes year over year isn't the math; it's the attacker's hardware.

A single modern GPU (2026 consumer cards, Hashcat with -m 22000) can attempt tens of billions of NTLM hashes per second, and cheap cloud clusters push that into the trillions. Anything an old blog post called "safe" in 2015 is now trivially crackable if the site leaks its hash database.

2026 rulebook

Throwaway account, forum signup: 12 characters, random.
Real account you'd care about losing: 16 characters, random, mixed case + digits + symbols.
Primary email, banking, password manager master password: 20+ characters, or a 6–7 word Diceware passphrase.
Cryptocurrency wallet or seed backup: generate the wallet's own recovery phrase and store it offline. Don't invent your own.

Password length vs crack time (2026 hardware)

The table below assumes a fully random password from a 95-character alphabet and an offline attack against a leaked fast-hash database (roughly 10¹² guesses per second — one rented multi-GPU box). Slow hashes such as bcrypt or Argon2id buy you several orders of magnitude more time; never rely on that, because you don't control how a site stores your password.

Length	Entropy	Time to crack	Verdict
8 chars	~52 bits	minutes to hours	Unsafe
10 chars	~66 bits	~2 years	Weak
12 chars	~79 bits	~19,000 years	Minimum acceptable
16 chars	~105 bits	far beyond civilisation scale	Recommended
20 chars	~131 bits	effectively uncrackable	High-value accounts

Notice the shape of the curve: each extra character multiplies the work by 95. Going from 8 to 12 characters is a ten-billion-fold jump — far more valuable than adding another symbol type to a short password.

How many characters should a password be for each account type?

If you want a single number to remember: 16. It is long enough that offline cracking is irrelevant, short enough that you can type it on the rare occasion your manager won't autofill, and it exceeds every current NIST, CIS and OWASP baseline. Sites that cap passwords at 12 or 16 characters (still surprisingly common in banking) are telling you something uncomfortable about how they store them — use the maximum they allow and rely on 2FA.

What the standards actually say

NIST SP 800-63B — minimum 8, recommended support up to at least 64 characters, and no forced periodic rotation or composition rules. Length beats complexity.
OWASP ASVS — minimum 12 for standard accounts, with breached-password screening.
CIS Controls — 14 characters where multi-factor authentication is not enforced, 8 where it is.

All three converge on the same conclusion: the old "8 characters with an uppercase, a number and a symbol" rule is obsolete. A 16-character random string with no symbols is dramatically stronger than an 8-character one with all of them.

Random string vs passphrase

Both work if they have enough entropy. A random 16-character string from a full alphabet (~95 printable ASCII) has about log₂(95¹⁶) ≈ 105 bits of entropy. A six-word Diceware passphrase has about log₂(7776⁶) ≈ 77 bits — still comfortably beyond any offline attack, and dramatically easier to type.

Rule of thumb: if you'll ever type it on a phone, use a passphrase. If a password manager will type it for you, use a random string.

What makes a password weak

Reuse. The biggest single failure mode. One breach compromises every account with the same password.
Personal details. Birthdays, pet names, sports teams — all in every wordlist.
Predictable substitutions. P@ssw0rd is not stronger than Password. Attackers apply leet-speak rules automatically.
Short length. 8 characters, even fully random, falls in hours on a rented GPU.

Turn on 2FA anyway

Length matters most when a site's database leaks. It matters much less when the attacker just tries to log in through the front door — that's what rate limits and multi-factor authentication are for. A 20-character password behind hardware-key 2FA is the current gold standard for a personal email or password manager.

Generate one now

Our Password Generator creates cryptographically random passwords of any length, right in your browser. Nothing is sent to a server, nothing is logged, and the output is regenerated on every keystroke.

How many characters should a password be? Quick answers

Is a 12-character password strong enough? For a low-value account with a unique password and 2FA, yes. For email, banking or a password-manager master password, no — go to 16 or more.
Is 16 characters enough? Yes, for essentially every consumer account, provided the password is random and used nowhere else.
What about 20 or 24 characters? Use that length for your password manager's master password, root and admin credentials, and encryption keys you can never rotate easily.
Does adding symbols beat adding length? No. Each extra character multiplies the search space far more than swapping a letter for a symbol. Length wins every time.
What is the minimum password length in 2026? NIST's guidance sets 8 as an absolute floor for services, but 8 is not a safe personal choice — treat 16 as your own minimum.

Passphrase or random string?

A four-word passphrase is easier to type and remember but needs more characters to reach the same entropy as a random string. If you have to memorise it — your device login, your manager's master password — use five or six unrelated words. If a manager will store and autofill it, use a fully random 20-character string instead; there is no memory cost.

Length only helps if the password is unique

A 24-character password reused across three sites is weaker in practice than three unique 16-character ones, because a single breach exposes all three accounts. Credential stuffing, not brute force, is how most accounts are actually taken. Generate a fresh password per site with our password generator, store them in a manager, and turn on 2FA wherever it is offered.