How long a password should be.
NIST now asks for at least 15 characters where a password is the only key; what each extra character adds, and when symbols matter.
By Suraj Kumar2 min read
Length does more for a password than any rule about symbols.
15 characters.
NIST's 2024 guidelines ask for at least 15 characters when a password is the only thing that proves who you are, and 8 when it is one of two factors. They advise against forced mixtures of kinds and regular changes.
What each character adds.
With 94 printable characters each random one adds about 6.6 bits; with letters and digits only, about 6. So 16 characters of letters and digits are stronger than 12 of everything.
Sites with rules.
When a site asks for a symbol or a digit, turn on At least one of each kind; when it refuses some symbols, leave symbols out and make it longer.
Further reading
Topics: strong password generator · how long should a password be · password length · nist password guidelines · 16 character password
A little less theory. A little more doing.
Try it on your own terms, with a free browser tool.
Try the tool