How Long Should a Password Be? The 2026 Rules and Why Length Wins
Quick answer
A password should be at least 15 characters long if it is the only thing protecting an account. That is the minimum in NIST’s 2025 password rules, SP 800-63B-4. CISA, the US cyber defense agency, says 16 or more. If you also use a second login step, NIST allows 8 characters, but longer is still safer.
Free tool
Password Generator. Make a strong random password on your device in one click.
So how long should a password be in 2026? The rules changed in 2025, and many guides still repeat the old 8 character advice. This page shows what NIST and CISA say now, why length matters more than symbols, and how to make a password you can live with. Our password generator is set to 16 characters by default and shows the strength in bits.
How long should a password be? What NIST and CISA say
Two US government sources set the standard most companies follow. NIST raised its minimum in 2025, and CISA asks for one more character.
| Source | Minimum length | Other key rules |
|---|---|---|
| NIST SP 800-63B-4 (2025), password only | 15 characters | Allow at least 64 characters. Do not force a mix of character types. Do not force changes on a schedule. |
| NIST SP 800-63B-4, password plus a second factor | 8 characters | Same rules as above |
| CISA, Secure Our World | 16 characters | Make it random and use a different one for every account |
NIST also says sites should check new passwords against lists of common and leaked passwords, allow password managers and pasting, and accept spaces and Unicode characters. You can read section 3.1.1.2 of NIST SP 800-63B-4 and the CISA password advice for the full text.
NIST writes these rules for government systems and the services that check passwords. Private sites are free to set their own rules, so some still ask for 8 characters and a symbol.
Why length beats complexity
Each extra character multiplies the number of guesses an attacker needs. Adding length does more than adding symbols. The table below shows the possible combinations for random passwords.
| Random password | Possible combinations | Bits of randomness |
|---|---|---|
| 8 characters, all 94 keyboard characters | about 6.1 × 1015 | 52 |
| 16 characters, lowercase letters only | about 4.4 × 1022 | 75 |
| 12 characters, all 94 keyboard characters | about 4.8 × 1023 | 79 |
| 15 characters, all 94 keyboard characters | about 4.0 × 1029 | 98 |
| 16 characters, all 94 keyboard characters | about 3.7 × 1031 | 105 |
A 16 character password made of only lowercase letters has millions of times more combinations than an 8 character password that uses every type of character. Each bit of randomness doubles the number of guesses.
These numbers only hold for random passwords. A password a person makes up, such as Summer2026!, is far weaker than its length suggests, because cracking tools try common words, names and patterns first.
Passphrases: long passwords you can remember
A passphrase is a string of random words, such as five to seven words picked by chance. CISA suggests this for passwords you need to type or remember. The words must be truly random, not a quote, a song line or a phrase that means something to you.
| Random words from a 7,776 word list | Bits of randomness |
|---|---|
| 4 words | 52 |
| 5 words | 65 |
| 6 words | 78 |
| 7 words | 90 |
A six word passphrase is about as strong as a random 12 character password, and much easier to type. Use the character counter to check the length of a passphrase if a site sets a limit.
What are special characters in passwords?
Special characters are the symbols on a keyboard that are not letters or numbers. On a standard US keyboard there are 32 of them, plus the space. NIST says sites should accept all of them.
! " # $ % & ' ( ) * + , . / : ; < = > ? @ [ \ ] ^ _ ` { | } ~The list above shows 31 of them. The 32nd is the minus sign, which is easy to forget but counts as a special character too.
Some sites still block certain symbols or the space. If a site rejects a symbol, make the password longer instead. Length adds more strength than any single symbol.
How to make a strong password
- Let a password manager or generator make it, so it is truly random.
- Make it 16 characters or longer, or use a passphrase of six or more random words.
- Use a different password for every account. One leak should not open the rest.
- Turn on a second login step (MFA) wherever a site offers it.
- Change a password when there is a sign it leaked, not on a fixed schedule.
Avoid names, birthdays, pet names, sports teams and keyboard runs like qwerty or 123456. Cracking tools try these first.
Password myths to drop
| Myth | What the 2025 NIST rules say |
|---|---|
| Change your password every 90 days | Sites should not force changes on a schedule. Change it when there is evidence it was compromised. |
| A symbol makes any password strong | Length counts most. P@ssw0rd! is short and predictable. |
| Password hints help you remember | Hints that anyone can see are not allowed. |
| Pasting a password is unsafe | Sites must allow password managers and autofill, and should allow pasting. |
Frequently asked questions
Is 12 characters long enough for a password?
It meets many sites’ rules, but it is below the 15 characters NIST sets for accounts protected by a password alone and the 16 CISA recommends. Use 16 or more for important accounts such as email and banking.
What is the maximum password length?
NIST says sites should allow passwords of at least 64 characters. Some sites set lower limits, so use the longest length the site accepts that your password manager can handle.
Do I need uppercase letters, numbers and symbols?
Not under the 2025 NIST rules, which tell sites not to force a mix of character types. Many sites still require them, and a password generator can meet those rules for you.
How often should I change my password?
Only when there is a reason, such as a data breach or signs that someone else signed in. NIST no longer recommends changes on a fixed schedule.
Is a passphrase better than a random password?
A random passphrase of six or more words is about as strong as a random 12 character password and easier to type. For passwords stored in a manager, a random string of 16 or more characters is stronger still.
