Password strength comes mostly from length, as long as the characters are unpredictable. Here's what the math and current guidance suggest.
What NIST recommends
The US National Institute of Standards and Technology's digital identity guidelines (SP 800-63B) ask services to require at least 15 characters when a password is the only sign-in factor, and at least 8 when it's combined with another factor. They also advise against forced complexity rules and regular forced changes, and recommend allowing long passwords.
What length gives in entropy
Bits per character
log₂ 62equals5.95
Entropy
16 × 5.95equals95.3 bits
Average time
62¹⁶ ÷ 2 ÷ 10,000,000,000/sequalsLonger than the age of the universe
A random 16-character password has over 95 bits of entropy, beyond any practical guessing attack. By contrast, an 8-character random password with symbols has about 52.6 bits, which a fast offline attack can exhaust in days.
Practical defaults
- Password manager: let it generate 16 to 20 random characters for every account.
- Passwords you must type or remember: use a passphrase of several random words.
- Always add a second factor where it's offered; it matters more than any length rule.