Guides/How long should a password be
How long should a password be?
Length is usually the strongest everyday lever against guessing. Short “complex” passwords can still be weak; long unique secrets (especially from a manager) are harder to brute-force.
Practical ranges
- At least 12 characters when you must invent something memorable — longer is better.
- 16+ random characters from a password manager for important accounts.
- Passphrases: four+ unrelated words often out-length short symbol salads —passphrase vs complex.
- Site minimums (8 characters) are a floor, not a target.
Worked examples
P@ss1— meets “complexity,” fails on length.correct-horse-battery-staple-style length — stronger if unique and not a famous quote.- Manager 20-char random — you never need to memorize it —manager vs remembering.