What's the minimum safe password length?

NIST SP 800-63B sets 8 characters as the required minimum for user-chosen secrets, but explicitly frames it as a floor — the standard also recommends services accept at least 64 characters, which only makes sense if longer passwords are expected to be common and beneficial.

Is a longer password always more secure than a shorter one with more symbols?

Almost always, yes, for randomly-generated passwords. Each added character multiplies the number of possible passwords by the charset size, while adding a character class only multiplies by a smaller factor once. Two extra characters of length typically beats adding symbols to a password that didn't have them.

Why do banking sites sometimes cap password length at 12 or 16 characters?

Historically, some systems hashed passwords with algorithms or truncated storage fields that had length limits, or ran legacy code that never anticipated long inputs. It's considered a weak practice today — OWASP recommends applications support at least 64 characters — but plenty of older banking and legacy systems still impose low caps.

Does a longer master password for my password manager matter more than for regular site logins?

Yes. Your password manager's master password is the one password that, if compromised, exposes every other password you own. It's also the one you type by hand most often, which is why a long passphrase — not a short complex string — is the common recommendation for that specific password.

Guide

How Many Characters Should a Password Have? By Account

8 characters is a legal minimum, not a safe one. Here's what length actually makes sense per account, and why.

By Buğra SözeriPublished September 25, 2026

“How long should my password be?” doesn’t have one universal answer, because the right length depends on what’s behind the login and how the password gets typed. What follows is a length table by account type, built on the entropy math and the length-first stance NIST SP 800-63B has taken since it replaced complexity rules as the recommended default.

The floor: 8 characters, and why it isn’t a target

NIST SP 800-63B requires services to accept user-chosen secrets of at least 8 characters, and to support at least 64 — a strong hint about which direction the standard actually wants passwords to move. Eight characters is a compliance floor, not a safety target: at 8 fully-random alphanumeric- plus-symbol characters, entropy is only around 52 bits, comfortably inside the range modern cracking hardware can attack given a leaked hash. Treat 8 as “the minimum a site will let you enter,” not as a length you should actually pick.

Recommended length by account type

Account type	Recommended length	Why
Low-stakes / throwaway (forum, free trial)	12+ random characters	Low value if breached, but still deserves a unique password so a breach here can’t unlock other accounts.
Email, social media, shopping	16+ random characters	Email in particular is a recovery path into everything else you own — treat it like a high-value account.
Banking, tax, healthcare portals	16–20+ random characters (site maximum permitting)	High-value target with real financial or medical consequences if compromised.
Password manager master password	6+ random Diceware words (~77+ bits)	The one password typed from memory; a passphrase is faster and more reliable to recall than an equivalent-strength random string.
Home Wi-Fi (WPA2/WPA3)	16+ random characters	Rarely typed after setup (devices remember it), so there’s no readability cost to going long.

Why length beats adding character classes

The reasoning is the same formula behind every entropy guide on this site: entropy = length × log2(charset size). Going from a 62-character set (letters and digits) to a roughly 94-character set (adding symbols) raises bits-per-character from about 5.95 to about 6.55 — a small multiplicative gain applied once. Adding four more characters of length, by contrast, adds those 5.95–6.55 bits four separate times. If a site forces you to choose between a shorter password with every character class, or four more characters without symbols, take the length every time.

When you can’t go long

Some legacy systems still cap password length at 12 or 16 characters — a practice our general password guide covers in more depth, and one that OWASP’s guidance explicitly argues against. When you hit a low cap, use every available character class to maximize the charset, since length is no longer the lever you control. A capped 12-character password with the full symbol set (~79 bits) is still meaningfully stronger than the same length without symbols (~71 bits) — small, but it’s the only knob left. Where possible, pair a capped or otherwise weak login with two-factor authentication, which doesn’t depend on password length at all.

Frequently asked questions

What's the minimum safe password length?: NIST SP 800-63B sets 8 characters as the required minimum for user-chosen secrets, but explicitly frames it as a floor — the standard also recommends services accept at least 64 characters, which only makes sense if longer passwords are expected to be common and beneficial.
Is a longer password always more secure than a shorter one with more symbols?: Almost always, yes, for randomly-generated passwords. Each added character multiplies the number of possible passwords by the charset size, while adding a character class only multiplies by a smaller factor once. Two extra characters of length typically beats adding symbols to a password that didn't have them.
Why do banking sites sometimes cap password length at 12 or 16 characters?: Historically, some systems hashed passwords with algorithms or truncated storage fields that had length limits, or ran legacy code that never anticipated long inputs. It's considered a weak practice today — OWASP recommends applications support at least 64 characters — but plenty of older banking and legacy systems still impose low caps.
Does a longer master password for my password manager matter more than for regular site logins?: Yes. Your password manager's master password is the one password that, if compromised, exposes every other password you own. It's also the one you type by hand most often, which is why a long passphrase — not a short complex string — is the common recommendation for that specific password.

Sources & references

Authoritative references cited by this piece. Verified by Buğra Sözeri on the dates shown and re-checked at every deploy.

NIST SP 800-63B — Digital Identity Guidelines (Authentication and Lifecycle Management) — Sets the 8-character minimum for user-chosen memorized secrets and recommends allowing at least 64 characters(as of 2026-09-25)
CISA — Secure Our World: Use Strong Passwords — US government consumer recommendation of longer passwords and unique passwords per account(as of 2026-09-25)
OWASP — Authentication Cheat Sheet — Recommended minimum and maximum password lengths for application authentication systems(as of 2026-09-25)