Security Guide

📏 How Long Should a Password Be in 2026? NIST’s Updated Rules Explained

By Ateeq Y Tanoli, BestPasswordGenerator.org · September 5, 2026 · 8 min read · 1,621 words

A 10-character password with mixed case and symbols takes a modern GPU cluster roughly 90 minutes to crack through brute force — yet the average person still uses passwords of exactly 10 characters or fewer. The answer to how long your passwords should be is more specific than most guides admit: NIST SP 800-63B-4 sets 8 characters as the absolute minimum, but security professionals and the UK’s NCSC both recommend 15 characters or more as a practical 2026 baseline for any account that matters.

What NIST SP 800-63B-4 Says in 2026

NIST Special Publication 800-63B-4, the digital identity guideline governing U.S. federal systems and widely adopted worldwide, was updated in 2024 with the clearest password length guidance yet:

• Minimum length: At least 8 characters for user-chosen passwords (the floor, not the target)
• Maximum length: Verifiers must accept passwords of at least 64 characters — substantially more room than older systems allowed
• No mandatory composition rules: NIST explicitly discourages requiring uppercase, symbols, or numbers separately; these constraints add friction without meaningfully increasing security
• Breached password checks: All passwords must be checked against known compromised password databases before acceptance

The core insight from NIST: length is the dominant factor in password strength, not character variety. A 16-character lowercase passphrase is significantly more secure than an 8-character password crammed with symbols and numbers.

As NIST states in SP 800-63B-4, Section 5.1.1: “Password length has been found to be a primary factor in characterising password strength. Passwords that are too short yield to brute-force attacks as well as to dictionary attacks using words and commonly chosen passwords.”

The UK’s NCSC (National Cyber Security Centre) echoes this directly: “The most important factor in password strength is length. A long password that is easy to remember is better than a short, complex one that is difficult to type.”

CISA (Cybersecurity and Infrastructure Security Agency) reinforces the point in its 2025 password guidance: “Using longer passwords is the best way to improve security. A password of 16 or more characters is significantly stronger than a shorter password, even if the shorter one uses special characters.”

Password Crack Times by Length (2026)

The table below assumes a GPU-based attacker cracking bcrypt hashes (cost factor 12) — a realistic assumption for properly stored passwords. MD5 or SHA-1 stored passwords crack orders of magnitude faster.

Sources: Hive Systems 2026 Password Table; Security.org password strength research.

The jump from 12 to 15 characters is dramatic. Against modern GPU clusters, a 15-character mixed-character password would take longer than a human lifetime to crack through brute force alone. At 16 characters, the math becomes astronomical — and this is before accounting for proper salting and hashing by the website storing your password.

Why Length Beats Complexity: The Entropy Math

Password strength is measured in bits of entropy. Each character position contributes log₂(N) bits, where N is the size of the character set:

• Lowercase letters only (26 chars): 4.7 bits per character
• Lowercase + uppercase (52 chars): 5.7 bits per character
• Full printable ASCII (95 chars): 6.6 bits per character

Adding one character to a password multiplies the attacker’s search space by the entire size of the character set. Adding one special character to a short password increases the search space by a fraction — adding one character to the length multiplies it by 95.

Practical takeaway: A 16-character password using only lowercase letters (75 bits of entropy) is stronger than a 10-character password using full printable ASCII (66 bits). This is why NIST stopped recommending mandatory complexity rules — they optimise for the wrong variable.

Recommended Lengths by Account Type

Your password manager master password deserves special attention. Since it protects every other credential you own, it should be a memorable passphrase of 20 or more characters — one you never write down and never enter anywhere other than your password manager.

The Passphrase Solution: Long Passwords That Are Easy to Remember

The tension between “long password” and “memorable password” is solved by passphrases — strings of four or more random words. The EFF (Electronic Frontier Foundation) Diceware method generates passphrases like correct-horse-battery-staple that are simultaneously:

• Long (28 characters in this example)
• High entropy (~77 bits for four random dictionary words)
• Genuinely memorable — a string of words is far easier to retain than P@s5w0rd!7x

For accounts where you don’t need to memorise the password — anything you access via a browser or app — use a password manager to generate and store fully random passwords of 16–20 characters. A tool like NordPass generates cryptographically secure passwords of any length and stores them in a zero-knowledge encrypted vault, so you only ever need to remember one strong master passphrase.

You can also use our free password generator to instantly create a random password at your preferred length — no account, no sign-up required.

Common Password Length Mistakes to Avoid

1. Padding short passwords with predictable patterns

Adding !! or 123 to a short password only adds predictable characters, not real entropy. Cracker dictionaries include password123, password!!, and p@ssw0rd! as high-priority guesses. The characters are there; the randomness is not.

2. Accepting arbitrary maximum password limits without question

Some websites cap passwords at 16 or even 12 characters. This is a security flaw. If a site won’t accept a 20-character password, use the maximum it allows, enable MFA, and treat the site as less trustworthy than one that follows NIST guidance. NIST explicitly requires verifiers to support at least 64 characters.

3. Reusing long passwords across multiple sites

A 20-character password reused on five sites is no safer than a 10-character unique password against credential stuffing. Length protects against cracking; uniqueness protects against breach reuse. You need both. A password manager solves both problems simultaneously.

4. Assuming length replaces multi-factor authentication

Even a 25-character password can be phished, keylogged, or captured in a data breach. Password length is one defence layer; MFA is another. NIST, NCSC, and CISA all recommend enabling MFA wherever available — it remains the single most effective control against account takeover.

If you suspect your passwords have appeared in a breach, services like NordPass include a built-in data breach scanner that alerts you when your stored credentials show up in leaked databases — so you can update them before attackers test them against your accounts.

Frequently Asked Questions

What is the minimum password length recommended by NIST in 2026?

NIST SP 800-63B-4 requires verifiers to accept passwords of at least 8 characters. However, NIST recommends encouraging users to choose longer passwords — 15 characters or more — and that verifiers support up to at least 64 characters. The 8-character minimum is a regulatory floor, not a security target.

Is a 12-character password strong enough in 2026?

Against brute-force cracking of bcrypt-hashed passwords, 12 characters with mixed case and symbols is reasonably strong — estimated crack time is around 34 years on a GPU cluster. However, if that password appears in a known breach database, length becomes irrelevant; NIST requires that such passwords be rejected. In practice, 15 characters is a safer minimum for important accounts, and 16+ is the recommendation for banking and email.

Does password complexity matter more than length?

No. NIST SP 800-63B-4 explicitly discourages mandatory complexity rules (requiring uppercase, numbers, and symbols separately) because users respond with predictable substitutions — P@ssw0rd — that don’t meaningfully increase entropy. Every character added to a password’s length provides more security than substituting a letter for a symbol in a short password.

How long should a password manager master password be?

At least 20 characters, and ideally a passphrase of four or more random words. Your master password protects every credential you store, so it needs to be long enough to resist brute force (20+ characters gives over 100 bits of entropy) and memorable enough that you never write it down anywhere.

Why do some websites still limit passwords to 16 characters?

Legacy systems sometimes impose arbitrary maximum lengths because they store passwords in fixed-length database columns rather than using modern one-way hashing algorithms (which produce fixed-size output regardless of input length). A site that caps passwords at 16 characters or fewer may be storing credentials insecurely. Always enable MFA and use a unique password for any such site.