How Long Should a Password Be in 2026?
Password rules on websites still ask for "one uppercase letter, one number, one symbol". Those rules help a little, but the thing that matters most is simpler: length and randomness.
What makes a password strong
An attacker who steals a database of password hashes tries billions of guesses per second. What protects you is the number of possible passwords they'd have to try. Each extra random character multiplies that number by the size of the character set — by 26 for lowercase letters, by about 94 if you use all keyboard characters.
Strength is usually expressed in bits of entropy: every bit doubles the guessing work. A random 12-character password using letters, digits and symbols has about 79 bits; 16 characters has about 105.
Recommended lengths
| Use | Suggested length |
|---|---|
| Email, banking, password manager | 16+ characters (or a long passphrase you can type) |
| Ordinary accounts saved in a manager | 16–20 random characters |
| Wi-Fi network | 16+ characters, no confusing look-alikes |
The key word is random. "Summer2026!" is 11 characters but is one of the first things cracking tools try. Human-chosen passwords follow patterns; generated ones don't.
Generating one safely
The password generator uses your browser's cryptographic random generator (crypto.getRandomValues), and the password never leaves the page — nothing is sent or stored. Pick the length, choose character types, and copy. If you'll type it by hand (a TV, a router), turn on "avoid look-alikes" so you don't confuse l and 1.
Length isn't everything
- Never reuse passwords. When one site leaks, attackers try the same password everywhere else.
- Use a password manager so a 20-character password costs you nothing.
- Turn on two-factor authentication for email and money — it stops most account takeovers even if a password leaks.