Password length is the single setting that does the most for your safety, and it is the easiest to get right. This guide is part of our password basics series. If you are completely new to this, start with what a password is.
What the experts recommend
Official advice has moved towards longer passwords and away from complicated rules:
| Source | What it says |
|---|---|
| NIST (US standards body) | At least 15 characters for a password used alone. At least 8 if it is one part of multi-factor login. |
| CISA (US cyber agency) | At least 16 characters, or a memorable phrase of 4 to 7 unrelated words. |
| NCSC (UK cyber agency) | Three random words as a simple method, or a password manager to create strong passwords for you. |
Our recommendation sits at the careful end of those: 16 or more random characters from a password manager, and five or six random words for the few passwords you have to remember.
Why length matters so much
An attacker who steals a site's password data can try guesses on their own computers, as fast as their hardware allows. Each character you add multiplies the number of possibilities, so the work grows very quickly.
Read those bars as a comparison, not a promise. The figures assume a truly random password. If yours is based on a word, a name or a pattern, it will fall long before the maths suggests, because attackers try the likely guesses first.
Well-run sites also store passwords in ways that slow guessing down enormously, and login pages block repeated tries. You cannot see how a site protects your password, so choose one that is strong even if the site is careless.
How long should each kind of password be?
Not every password has the same job. Here is a practical guide:
| Password for | Recommended length | How to make it |
|---|---|---|
| Everyday websites | 20 random characters | Let a password manager generate it |
| Email and banking | 20 random characters, plus two-factor login | Let a password manager generate it |
| Password manager master password | 6 or more random words | Roll dice or use a generator, then memorize it |
| Phone or computer login | 5 or more random words, or a long PIN on phones | Choose randomly, then memorize it |
| Wi-Fi network | 20 or more characters | Generate it and keep it in your manager |
Long is not enough by itself
A long password can still be a bad one. Avoid these traps:
- Long but predictable.
passwordpasswordpasswordis long and useless. So is a famous quote or song lyric. - Long but reused. If a site leaks it, length no longer helps. Use each password once.
- Long but shared. A strong password typed into a fake site is a stolen password. Learn to spot a fake login page.
What about sites with strange rules?
Some sites still demand a capital letter, a number or a symbol, or cap the length. Do what they ask, then use the longest password allowed. Our article on password complexity explains why those rules exist and why experts are dropping them.