How Long Should a Password Be? A Practical Guide
When it comes to password strength, length wins. Each extra character multiplies the number of guesses an attacker needs, while swapping an "a" for an "@" in a common word adds almost nothing.
How many characters?
- At least 12 characters for ordinary accounts.
- 16 or more for email, banking, work and your password manager, because these unlock other accounts.
- Random passwords of 16+ characters are practically impossible to brute-force with current technology.
Random beats clever
People are predictable: names, dates, pet names and keyboard patterns are the first things attackers try. A random password has no pattern to exploit. Our Password Generator creates one with a secure random source and shows its strength in bits of entropy.
Use a different password everywhere
When a website is breached, attackers try the leaked email and password on other services. A unique password per account stops one breach from becoming many.
Store them in a password manager
Nobody can remember dozens of random passwords. A reputable password manager remembers them for you and fills them in. Protect it with one long, memorable passphrase made of several unrelated words.
Turn on two-factor authentication
A second step, such as an authenticator app or a security key, protects you even if a password leaks.
What to avoid
- Reusing passwords
- Using personal details
- Sending passwords in chat or email
- Saving them in an unprotected notes file
Need to share a Wi-Fi password with guests? Make a Wi-Fi QR code they can scan instead of reading it out.