How Long Should a Password Be?

Password length is one of the simplest ways to improve account safety. A short password can look complicated and still be weak, while a longer random password is usually harder to guess or crack.

The right length depends on the account. A throwaway forum login is not the same as email, banking, hosting, cloud storage, or a password manager master password.

Use 16 characters as a practical minimum

For most normal accounts, 16 characters is a practical baseline. It gives more protection than common 8 to 12 character passwords and still works on most modern websites.

Length should not come from predictable filler. A long password built from your name, birthday, website name, or a repeated word is still weak.

• Use 16 or more characters for everyday accounts.
• Avoid repeated words or repeated keyboard patterns.
• Use a unique password for every account.

Use 20 or more characters for important accounts

Email, banking, cloud storage, hosting, domain registrar, business admin, and password manager accounts deserve stronger defaults. Use 20 characters or more when the service allows it.

These accounts often protect other accounts indirectly. If someone controls your email or hosting account, they may be able to reset passwords or change public business assets.

Length beats clever substitutions

Replacing letters with symbols can help only a little if the base word is predictable. Attackers know substitutions such as a for @, o for 0, i for 1, and s for $.

A generated 20-character password is usually better than a shorter password based on a word with substitutions.

• Weak: P@ssword2026 because the base word is obvious.
• Better: a generated password with no personal meaning.
• Better for typing: a random passphrase with enough words.

What if a website limits password length?

Some older websites limit password length or block certain symbols. If a service does that, use the longest password it accepts and keep it unique.

Do not reuse a shorter password just because the website has poor rules. Generate a separate password for that account and store it safely.

Practical examples

• Everyday account: 16 to 20 generated characters.
• Email account: 20 to 24 generated characters plus MFA.
• Wi-Fi password: a long passphrase can be easier to share safely.
• Password manager master password: use a long random passphrase you can remember.

Helpful related tools

Password GeneratorOpen this related The Pass Key resource.Strong Password GeneratorOpen this related The Pass Key resource.Secure Password GeneratorOpen this related The Pass Key resource.Password Strength CheckerOpen this related The Pass Key resource.Passphrase GeneratorOpen this related The Pass Key resource.PIN GeneratorOpen this related The Pass Key resource.Password Security BlogOpen this related The Pass Key resource.

FAQ

Is 12 characters enough for a password?

Twelve characters can be better than shorter passwords, but 16 or more is a stronger modern baseline for most accounts.

Should important accounts use longer passwords?

Yes. Use 20 or more characters for email, banking, cloud, hosting, and business admin accounts when possible.

Does password length matter more than symbols?

Often yes. Symbols can help, but a long random password is usually better than a short predictable password with symbols.

Conclusion

A good default is 16 or more characters for normal accounts and 20 or more for important accounts.

Make every password unique, generate it privately, and store it in a password manager.