How Long Should a Password Be? 8, 12 or 15+ Characters Explained

The short answer

Use at least 15 characters for any password that is the only thing protecting an account, and at least 8 where the account also has a second factor such as an OTP or an authenticator app. That is the current line in NIST's Digital Identity Guidelines (SP 800-63B-4). Length matters more than adding a symbol. You can see the effect on estimated crack time in the Password Strength Checker, and create a random long password with the Password Generator.

What NIST's current guidance says

NIST's SP 800-63B-4, the US government's reference for password rules that many companies copy, says:

• Passwords used as a single factor must be at least 15 characters.
• Passwords used only as part of multi-factor login must be at least 8 characters.
• Services should allow passwords of at least 64 characters.
• Services must not force composition rules such as "one uppercase, one number, one symbol".
• New passwords must be checked against a blocklist of common, expected or leaked passwords.
• Services must not force periodic password changes, only a change when there is evidence of compromise.
• Spaces and Unicode characters should be accepted, so passphrases are allowed.

These rules are written for websites and apps, not for you. But they tell you what actually protects an account: a long password that is not on any leaked list, used on one site only.

Why length beats complexity

Every extra character multiplies the number of possible passwords. Adding character types also helps, but less than you might think, and people add them in predictable places (a capital at the start, 1 or ! at the end).

The Lazyblink checker estimates brute-force time with a simple formula: the size of the character set raised to the power of the length, divided by 10 billion guesses per second (a fast GPU attack). It adds 26 for lowercase, 26 for uppercase, 10 for digits and 32 for symbols. Here is what that model gives for random passwords:

Length	Only lowercase (26)	All four types (94)
8	about 21 seconds	about 7 days
10	about 4 hours	about 171 years
12	about 110 days	about 1.5 million years
14	about 205 years	about 13 billion years
16	about 138,000 years	far longer

Two things stand out. An 8-character password with every character type is weaker than a 14-character password of plain lowercase letters. And going from 12 to 16 lowercase characters adds more protection than switching 12 characters to mixed types.

These numbers assume truly random characters. Real attackers do not guess randomly. They try leaked passwords, dictionary words and common substitutions first.

Why the checker can call a bad password "Strong"

Try P@ssw0rd2026 in the checker. It has 12 characters, all four character types and no obvious sequence, so it ticks 9 of the 10 boxes, gets a Strong label and an estimated crack time of Centuries.

In reality it is one of the first things an attacker would guess: a common word, the usual letter swaps (a to @, o to 0) and a year. The checker's common-password test only looks for an exact match against ten very common passwords such as password and 123456, so it cannot spot variations like this.

The same applies to password123. The checker rates it Fair with about 152 days, because it is not an exact match for password. Any real cracking tool would guess it in seconds.

So read the checker as a measure of length and variety, not as proof that a password is safe. The full meaning of each score is in what the strength score and crack time mean.

How to get to 15 characters without forgetting it

Option 1: a passphrase

Pick four or more unrelated words, ideally chosen at random rather than a phrase you would say. For example, mango river chalk lamp is 22 characters including spaces. The checker counts the spaces as symbols, so it reports 58 possible characters per position and a crack time of Centuries.

Rules for a good passphrase:

• Words should be random, not a quote, song line or slogan.
• Avoid personal facts: names, cities, birth years, your team.
• Four words is the minimum. Five is better for important accounts.
• If a site rejects spaces, join the words with hyphens.

Option 2: a random password in a password manager

For most accounts you never need to remember the password. Let a password manager store it and fill it in. Then you can use a 20-character random string from the Password Generator for every site, each one different.

You still need to remember a few: the password manager's master password, your phone or computer login, and your main email. Make those long passphrases.

Where 8 characters is acceptable

NIST's 8-character minimum applies only where the password is one of two factors. Typical examples are an account that always asks for an OTP or authenticator code after the password, and a PIN on a device that locks after a few wrong attempts.

Even then, 8 is a floor, not a target. If the second factor is ever turned off, or an attacker gets a copy of the site's password database, a short password is the weak point.

Common mistakes

• Reusing a long password. A 20-character password that was leaked from one site is useless everywhere else. Use a different one for every account.
• Adding a number at the end when forced to change. Mango2025 becoming Mango2026 gives almost no extra protection.
• Trusting a green bar. Strength meters, including this one, measure structure. They cannot know whether a password has already leaked.
• Typing real passwords into random websites. The Lazyblink checker runs entirely in your browser and does not send what you type anywhere, but it is still a good habit to test a password with the same structure rather than your actual one.
• Stopping at length. Turn on two-factor authentication for email, banking and social accounts. It protects you even if a password leaks.

A quick routine

Pick the accounts that matter most: email, bank, phone account, password manager.

Give each a unique passphrase of four or five random words, or a long random password stored in a manager.

Turn on two-factor login wherever it is offered.

Check a sample password of the same shape in the Password Strength Checker to see how length changes the estimate.

Change a password when a service reports a breach, not on a calendar.