The complete guide to password entropy, length, character sets, and how to protect your accounts from modern attacks.
| Length | Character Set | Possible Combos | Entropy | Strength |
|---|---|---|---|---|
| 8 | Lowercase only | 200 billion | 37 bits | Weak |
| 8 | Upper + Lower | 53 trillion | 45 bits | Weak |
| 8 | All types (94 chars) | 6.1 quadrillion | 52 bits | Medium |
| 12 | All types | 475 quintillion | 78 bits | Medium |
| 16 | All types | 36 sextillion | 105 bits | Strong |
| 20 | All types | 2.8 septillion | 131 bits | Very Strong |
| 24 | All types | 220 octillion | 157 bits | Unbreakable |
Every additional character multiplies the number of possible passwords by the size of the character set. A 20-character lowercase password has 26^20 = 19.9 septillion combinations — orders of magnitude more than an 8-character complex password (94^8 = 6.1 quadrillion).
Using uppercase (A-Z), lowercase (a-z), numbers (0-9), and symbols (!@#$%) maximizes the character set size. The number of possible passwords = (charset size)^(length). Larger charset size = exponentially stronger passwords for the same length.
The most common way accounts get compromised is credential stuffing — attackers use leaked passwords from one site to try logging in to other sites. A unique password for every account means one breach does not cascade. Use a password manager.
Attackers use rule-based cracking: dictionary words with number suffixes (password123), keyboard walks (qwerty), common substitutions (p@ssw0rd), and popular base words. None of these patterns survive targeted attacks even at 12+ characters.
At minimum 16 characters for general accounts. For high-value accounts (email, banking, password manager master password), use 20+ characters. If a site limits password length below 16, note it as a security red flag.
Passphrases (4+ random dictionary words) are both strong and memorable: "correct-horse-battery-staple" has ~44 bits of entropy per word. For accounts requiring memorization, a 5+ word passphrase is excellent. For everything else, a random 20-character password stored in a password manager is stronger.
Modern security guidance (NIST SP 800-63B) no longer recommends mandatory periodic password changes unless there is evidence of compromise. Changing passwords frequently encourages weak, predictable patterns. Instead: use strong unique passwords and change immediately if a breach is suspected.
A 16-character random password with all character types has ~105 bits of entropy. At 100 trillion guesses per second (current GPU clusters), cracking it would take longer than the age of the universe. In practice, attackers rely on stolen hashes, phishing, or reuse — not brute force of truly random passwords.
Use our free password generator to create a cryptographically secure password in one click.
Open Password Generator →