Password length
What each password length is actually worth, in bits and in time, and where the useful range ends.
Eight characters is the answer to a 1990s question
It is still what most password policies ask for, and it has not been adequate for a long time. A random eight-character password is 51.5 bits and falls to a fast offline attack in 27 minutes. Sixteen characters is 103.1 bits and the same attack takes 171 billion years.
The gap is not a slope, it is a cliff, because entropy grows linearly with length and the search space grows exponentially with entropy. Four more characters multiplies the work by 57,289,761.
Every length
| Length | Entropy | Fast offline | Bcrypt | Rate limited | Verdict |
|---|---|---|---|---|---|
| 6 | 38.7 bits | instantly | 251 days | 69 years | Not usable. |
| 8 | 51.5 bits | 27 minutes | 5.2 thousand years | 520 thousand years | The old minimum, and no longer enough. |
| 10 | 64.4 bits | 144 days | 39 million years | 3.9 billion years | Borderline. |
| 12 | 77.3 bits | 3.0 thousand years | 298 billion years | longer than the universe has existed, by a wide margin | The practical minimum for anything that matters. |
| 14 | 90.2 bits | 23 million years | longer than the universe has existed, by a wide margin | longer than the universe has existed, by a wide margin | Comfortable. |
| 16 | 103.1 bits | 171 billion years | longer than the universe has existed, by a wide margin | longer than the universe has existed, by a wide margin | The sensible default. |
| 18 | 116.0 bits | longer than the universe has existed, by a wide margin | longer than the universe has existed, by a wide margin | longer than the universe has existed, by a wide margin | Beyond the useful range. |
| 20 | 128.9 bits | longer than the universe has existed, by a wide margin | longer than the universe has existed, by a wide margin | longer than the universe has existed, by a wide margin | Symbolic. |
| 24 | 154.6 bits | longer than the universe has existed, by a wide margin | longer than the universe has existed, by a wide margin | longer than the universe has existed, by a wide margin | Well past any threat. |
| 32 | 206.2 bits | longer than the universe has existed, by a wide margin | longer than the universe has existed, by a wide margin | longer than the universe has existed, by a wide margin | Arbitrary. |
Two characters equal one word
A keyboard character chosen at random from 87 possibilities carries 6.443 bits. A word chosen at random from a 7,776-word diceware list carries 12.925. Two characters is 12.89 bits and one word is 12.92 — within half a per cent.
So a 12-character password and a 6-word passphrase are the same strength, and the passphrase is enormously easier to type on a phone. Neither is better; they are the same thing measured differently.
The number that is not on this page
Every figure here assumes every character was chosen at random. A password a person invented carries a small fraction of the entropy its length implies, because people substitute predictably — a 3 for an E, an exclamation mark at the end, a year that is either this one or a birthday. Attackers model that, and the models are good.
Which makes the practical advice short: let a generator choose, and let a manager remember. The length only means what this page says it means if you did not pick the characters yourself.
One more character beats adding symbols
The perennial argument has an arithmetic answer. A 12-character password drawn from letters and digits alone — 62 possibilities per position — carries 71.5 bits. Adding the full symbol set here takes each position from 62 to 87 choices, which buys 5.9 bits across the whole password.
Making it thirteen characters instead, and keeping it letters and digits, buys 6.0 bits — more, from one keystroke rather than twelve harder-to-type ones. It is close — 6.0 against 5.9 — and a second extra character puts it beyond argument.
Symbols are not useless; they are simply the smaller lever, and they cost the most where passwords are typed on a phone or read aloud. If a policy forces them, add them. If it does not, add length.
"Cracked in" depends entirely on how it is stored
A crack time is a guess rate multiplied by a search space, and the guess rate is not a property of the password. The same 12-character password faces three completely different numbers:
| Attack | Guesses per second | 12 characters lasts |
|---|---|---|
| Fast unsalted hash on GPUs — MD5, SHA-1, unsalted SHA-256 | 10¹² | 3.0 thousand years |
| bcrypt or Argon2, correctly configured | 10⁴ | 298 billion years |
| A rate-limited login form | 100 | longer than the universe has existed, by a wide margin |
The gap between the first and second rows is eight orders of magnitude, and it is entirely the service's choice rather than yours. Which is the uncomfortable part: the length you pick matters most precisely when the site storing it has done the wrong thing, and you have no way to find out which sites those are.
It also means "how long should my password be" has no single answer, and any page giving one — including the numbers above — is quietly assuming the worst case. That is the right assumption to make, and it is worth knowing it is being made.