How Long Should a Password Be?
Updated 11 November 2026 · Metro Research editorial team · How we test
Password advice is often vague. Here is the arithmetic for randomly generated passwords, so you can see why length is the setting that matters most.
Estimated time to guess a random password
| Character set (size) | 8 characters | 12 characters | 16 characters | 20 characters |
|---|---|---|---|---|
| Lowercase only (26) | under 1 second | about 13 hours | about 690 years | 300+ million years |
| Upper + lowercase (52) | about 27 seconds | about 6 years | 45+ million years | astronomical |
| Letters + digits (62) | about 2 minutes | about 51 years | 750+ million years | astronomical |
| Letters, digits, symbols (85) | about 23 minutes | about 2,250 years | 100+ billion years | astronomical |
Assumes an offline attacker making one trillion (1012) guesses per second against a fast, unsalted hash, and finding the password after searching half the possibilities on average. Slow password hashes used by well-run services make real attacks far slower. Human-chosen passwords are much weaker than these random figures.
What the table shows
- Each extra character multiplies the work. Going from 12 to 16 characters with all four sets raises the estimate from thousands of years to more than a hundred billion.
- Symbols help less than length. A 16-character password of letters only is far stronger than an 8-character password with every symbol.
- 8 characters is no longer enough for anything important, even with symbols.
Our recommendation
Use at least 16 random characters for important accounts, a different password for every site, and a password manager to remember them. Turn on two-step verification wherever it is offered; it protects you even if a password leaks.
How the numbers were calculated
Strength in bits = length × log2(character-set size). Our generator's full set has 85 characters (26 + 26 + 10 + 23 symbols), so 16 characters give about 103 bits. Time = 2bits ÷ 2 ÷ guesses per second.
Frequently asked questions
Is a passphrase better?+
Four or more random words can be strong and easier to type, but they must be chosen randomly, not from a favorite quote.
Does this generator store my passwords?+
No. Passwords are created with your browser's cryptographic random generator and never leave your device.
Written for the current Metro Research tools. Spot an error? See our quality and corrections policy.