How long should a password be? The minimum safe length in 2026

Use 16+ characters. Use a password manager to generate and store them so you don't have to remember them. Length is your primary defense against brute-force attacks. Complexity (mixing character types) helps, but length matters far more.

Password length is the single most important factor in password strength. An 8-character password drawn from all 95 printable ASCII characters can be brute-forced by a modern GPU cluster in hours. A 12-character password takes centuries. A 16-character password is effectively uncrackable by any known attack with current hardware. Length beats complexity every time.

By TechCompare · Updated August 2026

Security domain

Best Practices

Practical password security advice

Topic focus

Password length guide

password-length

How this is calculated

The math: a password's keyspace is characterSetSize^length. With 95 printable ASCII characters, an 8-character password has 95^8 ≈ 6.6 × 10^15 combinations. A single RTX 5090 can test roughly 10^10 hashes per second against fast hashes like MD5 or NTLM. That's 6.6 × 10^5 seconds, or about 7.6 days for the entire keyspace, and 3.8 days on average. Against bcrypt (which is deliberately slow), the same attack would take millennia. But you don't know which hash algorithm the service uses, and many still use fast hashes. A 16-character password has 95^16 ≈ 4.4 × 10^31 combinations, taking longer than the age of the universe on any hardware. For reference, NIST SP 800-63B recommends a minimum of 8 characters for user-chosen passwords and 6 characters for randomly generated ones, but these are minimums from 2017. Modern guidance is 12 minimum, 16+ recommended.

Verdict

The keyspace math is what settles the length versus complexity debate. At 95 printable ASCII characters, an 8-character password holds about 6.6 x 10^15 combinations, which one RTX 5090 at 10^10 hashes per second cracks in about 3.8 days average against fast hashes. Bumping to 16 characters pushes that to 4.4 x 10^31, longer than the age of the universe. NIST's 2017 floor of 8 is a minimum, not a target.