How Long Should a Password Be in 2026?

"At least 8 characters, with an uppercase letter, a number and a symbol" is still the rule on countless sign-up forms. It produced a generation of passwords like Password1!, which meet every rule and fall in seconds. Here's how to think about password strength in a way that actually reflects how passwords are attacked.

How passwords really get cracked

Very few attacks involve someone typing guesses into a login form. Those are rate-limited and easily detected. The dangerous scenarios are:

• Credential stuffing. A site you used years ago gets breached, and attackers try your email and password on hundreds of other sites. Length doesn't help at all here. Only using a unique password per site does.
• Offline cracking. Attackers steal a database of password hashes and guess at full speed on their own hardware. With a fast hash like unsalted MD5 or SHA-1, a single modern GPU can try tens of billions of guesses per second. With a slow hash like bcrypt or Argon2, it might be thousands. Length matters enormously here.
• Phishing. A fake login page simply asks for your password. No password strength helps; two-factor authentication with a passkey or security key does.

Entropy, without the maths headache

Entropy measures how many guesses it would take to be sure of finding a password, expressed in bits. Each bit doubles the work. For a randomly generated password, entropy is length × log₂(size of the character pool):

Two things jump out. First, symbols add surprisingly little: going from 62 to 94 characters adds only about 0.6 bits per character. Adding one more character to the length adds around 6 bits. Second, this only works for random passwords. A human-chosen password has far less entropy than its length suggests, because attackers try dictionary words, names, dates, keyboard patterns and predictable substitutions (@ for a) first.

What current guidance says

The US National Institute of Standards and Technology (NIST SP 800-63B, in its latest revision) is the most widely referenced standard, and it reads very differently from old corporate password policies:

• Require at least 8 characters, recommend 15 or more, and allow at least 64.
• Don't impose composition rules like "must contain a symbol".
• Don't force periodic password changes; only require a change if there's evidence of compromise.
• Check new passwords against lists of known breached and common passwords.
• Allow pasting, so password managers work.

Practical lengths

A passphrase like orbit candle velvet thunder pickle is easy to remember and type, and if the words were chosen randomly from a 7,776-word list (the "diceware" list), five of them give about 65 bits. The key word is randomly; a memorable phrase you made up yourself is much weaker.

If you build login systems

• Hash passwords with Argon2id, bcrypt or scrypt, never with plain SHA-256 or MD5.
• Set a generous maximum length (at least 64 characters) and accept any Unicode character.
• Check against a breached-password list such as the Have I Been Pwned Pwned Passwords API, which can be queried without sending the full password.
• Rate-limit login attempts and offer passkeys.

The short answer

If a password manager generates it: 16 characters or more, random, unique per site. If you have to remember it: five or more random words. And for anything important, turn on two-factor authentication, because the strongest password in the world can still be typed into a phishing page. When you need one, the password generator shows the entropy of every password it creates, so you can see exactly what you're getting.