Password Length vs Complexity: Which Matters More?

For years, password rules focused on complexity: one uppercase letter, one number, one symbol. Modern guidance, including from the US National Institute of Standards and Technology (NIST), puts far more weight on length.

The math in one table

All passwords below are randomly generated:

A random 16-character lowercase password is stronger than a random 8-character password using every character type. Doubling length roughly doubles entropy; adding character types raises it more slowly.

Why complexity rules backfired

When people are forced to add symbols, they do it predictably: capital first letter, number at the end, "@" for "a". Attackers build these patterns into their tools, so the real gain is small, while the passwords become harder to remember and type.

The practical sweet spot

• Use a random password generator with all character types, because it costs nothing when a password manager stores the result.
• Set a length of 16 or more for normal accounts and 20 or more for email, banking and work.
• If a site rejects symbols, turn them off and add four extra characters.
• For passwords you must type often, consider a long random passphrase instead.

Length limits on websites

Some older sites cap passwords at 16 or 20 characters. Use the maximum they allow. Current NIST guidance says services should accept passwords of at least 64 characters, so very short caps are a sign of outdated security.

Frequently asked questions

How long should a password be?

At least 16 characters for online accounts, and 20 or more for email, banking and your password manager master password. Current NIST guidance sets a minimum password length of 15 characters when a password is the only sign-in factor.

Is 8 characters enough for a password?

No. Is 8 characters enough for a password today? Even a random 8-character password can be cracked quickly after a data breach using GPU password cracking. Use 16 or more.

Is a 12 character password secure?

A random 12 character password using all four character types (about 78 bits) is reasonably strong for many accounts, but 16 characters gives a much bigger safety margin at no extra effort when a password manager stores it.

Are symbols necessary in passwords?

Not strictly. Are symbols necessary in passwords? They add strength, but length adds more. A password without symbols is fine if you add a few extra characters. Use special characters for passwords when a site's password requirements demand them.

What is the maximum password length?

Many sites allow 64 characters or more, and NIST recommends services accept at least 64. A very low maximum password length, such as 12 or 16, is a sign of outdated security practices. Password rules like this are set by each website.