How Long Should a Password Actually Be?

Password advice usually arrives as a list of rules with no reasoning attached, which is why people follow the letter of it and end up with Summer2026! on nine accounts. The arithmetic is not complicated, and once you have seen it the rules make sense on their own.

The arithmetic, briefly

A password's strength is the size of the set of things it could have been. Twelve random lowercase letters gives 26¹², which is about 9.5 x 10¹⁶ combinations, or 95 quadrillion. Now assume an attacker with a stolen password database and hardware that manages a billion guesses a second. That is 9.5 x 10⁷ seconds to try everything, roughly three years, and on average they find it in half that.

Use the full printable keyboard instead, about 95 characters. Twelve of those gives 95¹², around 5.4 x 10²³, which is nearly six million times larger. The same machine now needs on the order of seventeen million years. Same length, wildly different outcome, and that gap is the entire argument for using a generator rather than your own head.

Why substituting 0 for o buys almost nothing

Turning "password" into "p@ssw0rd" feels clever. It is not, because attackers apply exactly those substitutions to dictionary words before they try anything else. The transformation adds a handful of guesses to a list that already contains your base word. Unpredictability is what counts, and a rule you can describe in one sentence is not unpredictable.

Passphrases, and how many words you need

Random words are easier to type and remember than random characters, but you need more of them than people assume. Using the standard 7,776-word list, four random words gives 7,776⁴, about 3.7 x 10¹⁵. At a billion guesses a second that is around 42 days. Not enough.

Five words gives 2.8 x 10¹⁹, which pushes the same attack out to roughly 900 years. Six words gives 2.2 x 10²³, landing in the same territory as twelve random keyboard characters. So six words for anything you have to memorise, such as the master password on your vault or your device login. Everything else should be generated and stored, because you are not going to memorise ninety of them.

Using the generator without shooting yourself in the foot

Set the length first, since it moves the result most. Sixteen is a sensible floor for anything generated. Turn on lowercase, uppercase, digits and symbols unless the site refuses them. The option to exclude ambiguous characters like l, 1, I and 0 is worth using only when you will type the password by hand off a screen, because it shrinks the character set in exchange for not mistyping it four times.

Generate the password and paste it into the site and your password manager in the same sitting. Do not park it somewhere temporary intending to move it later. The random number generator underneath works on the same principle, and a comparison of the available password generators covers which tools store what.

Where length limits bite

Plenty of banks still cap passwords at 12 or 16 characters and quietly truncate anything longer, which is how people end up locked out by a password that worked the day they set it. If a site rejects your symbols or has a short maximum, generate the longest thing it accepts and turn on two-factor authentication, which matters far more than the last four characters.

Common questions

Is 12 characters long enough in 2026? With the full character set, yes for most accounts. With letters only, no. The 12-character advice was written assuming mixed characters, and that is the part people quietly drop.

Should I change my passwords every 90 days? Forced rotation has fallen out of favour with security bodies, because it pushes people towards predictable increments. Change a password when there is a reason: a breach notice, a shared device, or a suspicion.

Are passphrases actually as strong as random passwords? They can be, if the words are chosen randomly and there are enough of them. A phrase you invented yourself is weaker than it looks, because your word choices are not random.

Is it safe to use an online password generator? Use one that generates in your browser rather than on a server. Better still, use the generator built into your password manager, so the password never exists outside it.