How long should a password actually be?
Almost every guide answers this with a number and no reasoning, which is why the number keeps changing. The honest answer is that length is the one thing an attacker cannot work around, so it is the lever worth pulling first.
Length beats symbols, and it is not close
Each character you add multiplies the number of possibilities by the size of the character set. Adding a symbol set to a short password multiplies the total once. Adding four more characters multiplies it four more times. A twenty-character password of nothing but letters and digits has more combinations than a ten-character one using every symbol on the keyboard.
This is also why rules like "must contain a special character" do so little. They force everyone into the same small set of predictable substitutions — an exclamation mark at the end, an at-sign for an A — while the length stays short.
What the bits mean
A generated password is often labelled with a number of bits. That is entropy: the base-2 logarithm of how many equally likely passwords the generator could have produced. Every extra bit doubles the work for someone guessing. Rough bands:
- Under 40 bits. Weak. A modern machine can work through this offline in a practical amount of time.
- Around 60 bits. Fine for everyday accounts, especially ones that lock out after a few failed attempts.
- 80 to 100 bits. Beyond the reach of any realistic offline attack on a stolen password database.
- Above 100 bits. The password is no longer the weakest part of your security; something else is.
Entropy only counts if the password really was chosen at random. A twelve-character password you invented yourself has far less entropy than twelve random characters, because human choices cluster around words, dates and keyboard patterns that cracking tools try first.
Lengths worth using
- Email and banking: 20 random characters. Your email is the reset path for everything else, so it deserves the strongest one you have.
- Everyday accounts: 16 random characters. Comfortably past anything practical, and short enough to retype when a password manager is not available.
- Wi-Fi: 20 or more. A Wi-Fi handshake can be captured and attacked offline with no rate limiting, so this is one of the places length matters most. You type it rarely, so make it long.
- Throwaway sign-ups: 16 is still fine. There is no reason to go shorter — you are pasting it, not memorising it.
- Something you must memorise: a passphrase of six words. Around sixty-three bits, and you will actually remember it.
The cap that decides it for you
Some sites still impose a maximum length, occasionally as low as twelve or sixteen characters. When that happens, use every character the site allows and turn on every character type it accepts. A site with a low maximum is a hint that the password may be stored in a way it should not be, so it is also a good place to make sure the password is unique to that site.
What actually goes wrong
In practice, passwords are almost never broken by brute force on a well-chosen long password. They are broken because the same password was used somewhere else and that other place was breached. Length protects you from guessing; uniqueness protects you from everyone else's mistakes. You need both, and generating a new one each time is the cheapest way to get uniqueness.
Lockmint
Lockmint's recommended preset gives you twenty random characters with look-alike letters removed. Each result shows its entropy in bits and, next to it, a sentence saying what that means, so you are not left to interpret the number yourself. The length slider goes from 4 to 64 for the sites with awkward rules, and you can save those rules as a named preset.