TechCompare LogoTechCompare

How long should a password be? The minimum safe length in 2026

By TechCompare · Updated · How we check

Use 16+ characters. Use a password manager to generate and store them so you don't have to remember them. Length is your primary defense against brute-force attacks. Complexity (mixing character types) helps, but length matters far more.

Password length is the single most important factor in password strength. An 8-character password drawn from all 95 printable ASCII characters can be brute-forced by a modern GPU cluster in hours. A 12-character password takes about 43,000 years on average against a single RTX 5090 testing a fast hash. A 16-character password is effectively uncrackable by any known attack with current hardware. Length beats complexity every time.

Security domain
Best Practices
Practical password security advice
Topic focus
Password length guide
password-length
Try the live Password Generator. Generate a passphrase or random string with custom rules.
Edit in the full tool

How this is calculated

The math: a password's keyspace is characterSetSize^length. With 95 printable ASCII characters, an 8-character password has 95^8 ≈ 6.6 × 10^15 combinations. A single RTX 5090 can test roughly 2×10^11 hashes per second against fast hashes like MD5 or NTLM. That's 3.3 × 10^4 seconds, or about 9 hours for the entire keyspace, and 5 hours on average.

Against bcrypt (which is deliberately slow), the same attack would take millennia. But you don't know which hash algorithm the service uses, and many still use fast hashes. A 16-character password has 95^16 ≈ 4.4 × 10^31 combinations, taking longer than the age of the universe on any hardware.

For reference, NIST SP 800-63B-4 requires at least 15 characters when a password is the single authentication factor, or at least 8 when it is only one factor in MFA. Those are minimum requirements, not strength targets. A password manager-generated 16-character password is a sensible target.

Verdict

Use 16 or more characters, because the keyspace math settles the length versus complexity debate. At 95 printable ASCII characters, an 8-character password holds about 6.6 x 10^15 combinations, which one RTX 5090 at 2×10^11 hashes per second cracks in about 5 hours average against fast hashes. Bumping to 16 characters pushes that to 4.4 x 10^31, longer than the age of the universe.

NIST's current floor is 15 characters for single-factor passwords and 8 when the password is only part of MFA. Those are minimums, not targets.

More Passwords scenarios

Passphrase vs password
A password is a short string of mixed character types (like Kx9$mQ2!pR).
View details
Password manager guide
A password manager is a single encrypted vault that generates, stores, and autofills strong unique passwords for every account you have.
View details
NIST guidelines
NIST Special Publication 800-63B-4 is the US government's current guidance on digital identity, including password policy.
View details

Related guides

chmod 600 for private files
The permission mode required for storing password files locally.
View guide

Frequently asked questions

Is a 12-character password safe enough in 2026?
A random 12-character password can resist brute-forcing against a fast hash for a long time, but it is below NIST's current 15-character minimum when the password is the single authentication factor. Use at least 15 characters for single-factor access and 16 or more for a manager-generated target. With MFA, NIST permits a minimum of 8, but longer is still better.
Why is password length more important than complexity?
Because the keyspace grows exponentially with length and only linearly with character set size. Going from 8 to 12 characters multiplies the search space by 95^4 (a factor of about 81 million), while adding a symbol requirement adds far less. Complexity rules also push humans toward predictable patterns like capital first letter plus trailing digit.
What password length does NIST recommend?
NIST SP 800-63B-4 requires at least 15 characters when a password is the single authentication factor. When the password is only one factor in MFA, the minimum is 8 characters. These are verifier requirements, not a claim that 15 is an ideal target. A manager-generated password of 16 or more characters gives useful extra margin.

Related tools

CHMOD Configurator

Calculate Linux file permissions using checkboxes or octal numbers, then view the matching symbolic notation.

Use tool

Text Encoding Converter

Convert between Text, Base64, Binary, Hexadecimal, and Decimal formats.

Use tool

Cron Generator

Visually build standard 5-part cron expressions or translate them into readable schedules.

Use tool