How Long Should a Random Password Be?

Password length is one of the easiest security choices to control. A longer random password is usually safer than a short password with predictable substitutions.

There is no single perfect length for every situation, but there are practical defaults that work well for most people.

Everyday accounts

For everyday accounts, use at least 16 characters when the site allows it. This includes shopping, streaming, travel, newsletters, utilities, and forums.

The password should still be unique. A 16-character password reused on many accounts is a problem if one account is breached.

• Use 16+ characters.
• Use uppercase, lowercase, numbers, and symbols when possible.
• Store the password in a manager.

High-value accounts

For email, banking, cloud storage, hosting, password managers, domain registrars, and work admin tools, use 20 characters or more. These accounts can control money, identity, recovery, or public business assets.

Also enable multi-factor authentication or passkeys where available.

PIN length

A PIN is limited to numbers, so length matters a lot. Use the longest PIN the system allows, especially for devices, locks, and account recovery flows.

Avoid birthdays, repeated digits, addresses, phone number fragments, and simple patterns.

• Use 6 digits or more when available.
• Use 8+ digits for higher-risk numeric codes if supported.
• Do not reuse important PINs.

Passphrase length

A passphrase should use multiple random words. Four random words is a useful minimum for many cases, while five or more words is better for high-value accounts or master passwords.

Do not use famous phrases, song lyrics, personal memories, or quotes. The words should be random.

Practical examples

• Shopping account: 16-character random password.
• Email account: 20+ character random password plus 2FA.
• Phone PIN: longest numeric PIN the device supports.
• Master password: five or more random words.

Helpful related tools

Password GeneratorOpen this related The Pass Key resource.Random Password GeneratorOpen this related The Pass Key resource.Secure Password GeneratorOpen this related The Pass Key resource.Password Strength CheckerOpen this related The Pass Key resource.Passphrase GeneratorOpen this related The Pass Key resource.Password Security BlogOpen this related The Pass Key resource.

FAQ

Is 12 characters enough?

Twelve random characters can be much better than weak passwords, but 16+ is a stronger modern default for most accounts.

Should I make passwords longer if I remove symbols?

Yes. If a site blocks symbols, increase length and keep the password random.

Does longer always mean safer?

Longer helps when the password is random and unique. A long reused or predictable phrase can still be risky.

Conclusion

Use 16+ characters for everyday accounts and 20+ for high-value accounts. For PINs and passphrases, use the longest practical option supported by the service.

Length works best with randomness, uniqueness, and safe storage.