The short answer: 16 characters for personal accounts, 20+ characters for your most critical ones (email, banking, password manager). But the long answer explains why — and understanding the "why" helps you make better decisions for every account you own.
What the official guidelines say
NIST (National Institute of Standards and Technology), the US government body that sets cybersecurity standards, updated its password guidance in SP 800-63B. Key points: minimum 8 characters for user-chosen passwords, no mandatory complexity rules (no forced uppercase/symbols requirements), and — critically — support for passwords up to at least 64 characters. NIST shifted focus to length over complexity.
CISA (Cybersecurity and Infrastructure Security Agency) recommends "long, random, unique passwords" for all accounts, defining "long" as at least 16 characters in their public guidance materials.
Password manager defaults: Bitwarden defaults to 14 characters when generating, with a recommended minimum of 14–20. 1Password defaults to 20 characters. Dashlane defaults to 12, recommending 16+. The industry is converging around 16 as the practical standard.
Crack time by length (2026 GPU speeds)
All estimates assume a GPU-accelerated offline attack at 10 billion guesses per second — typical for a modern attacker with a fast hashing algorithm. Against properly hardened systems (bcrypt, Argon2 with high cost factors), these times would be much longer.
| Length | Character types | Entropy | Crack time |
|---|---|---|---|
| 8 chars | All types (94) | ~52 bits | ~1 hour |
| 10 chars | All types (94) | ~65 bits | ~3,000 years |
| 12 chars | All types (94) | ~78 bits | ~2 billion years |
| 14 chars | All types (94) | ~91 bits | ~1 trillion years |
| 16 chars | All types (94) | ~104 bits | Billions of trillions of years |
| 20 chars | All types (94) | ~131 bits | Beyond any conceivable attack |
Note: these estimates assume fully random passwords. Passwords based on words, patterns, or personal information have far lower effective entropy regardless of length.
The 8-character myth
For years, 8 characters was the standard. It came from an era when computers were orders of magnitude slower and offline cracking wasn't feasible for most attackers. Today, a commodity GPU can test 10+ billion password hashes per second against a stolen password database. An 8-character password with all character types, while technically providing 52 bits of entropy, is cracked in about an hour under these conditions.
More problematically, many 8-character passwords don't use all character types, or use predictable patterns (Passw0rd!, Summer23!, Company1!). These fall in seconds or minutes to dictionary-rule attacks. The 8-character minimum is outdated for any account that matters.
Recommended lengths by account type
- ✓Email account: 16–20 characters — Your email resets all other accounts — it's your master key.
- ✓Banking / financial: 16–20 characters — High-value target; even small breaches have large consequences.
- ✓Password manager master: 20–30 characters — The one password protecting all others — use a long passphrase.
- ✓Work / corporate accounts: 16 characters — Breaches here affect your employer and colleagues too.
- ✓Social media: 14–16 characters — Valuable for identity theft and platform manipulation.
- ✓Shopping / e-commerce: 12–16 characters — Payment info may be stored; use unique passwords.
- ✓Low-value forums / newsletters: 12 characters — Lower risk, but still unique per site.
Length vs complexity: the current consensus
The cybersecurity community has largely settled this debate: length beats complexity when you're choosing between the two. A 20-character lowercase-only random password (94 bits) is stronger than a 10-character password using all character types (65 bits). Length wins.
But you don't have to choose — with a generator, you get both. Maximum length and full character pool is always the best option. The generator does the work; you just copy and save it to your password manager.