Decision point
The practical question on this page is not simply “is how long should a password be? secure?” It is which account, device or recovery path changes after the decision.
For How Long Should a Password Be?, this is a security concept page. Its goal is to translate the threat into a concrete account decision. Prioritize the primary email, reused passwords and recovery paths before making cosmetic changes.
Practical answer
Understand practical password length recommendations, NIST guidance and why length must be combined with uniqueness and randomness. The safest implementation is the one you can use consistently without reusing passwords or weakening recovery.
Current baseline
For passwords used as a single authentication factor, current NIST guidance requires verifiers to set a minimum of at least 15 characters and recommends supporting a maximum of at least 64 characters. A service may use a shorter minimum when the password is only one part of multifactor authentication, but users should still prefer longer unique values.
Length is not the only factor
A 20-character password copied across ten sites creates more risk than ten unique random passwords. Random generation, uniqueness, secure storage and account recovery all matter.
Practical choices
Use 18–24 random characters for important accounts when supported. For a master password you must remember, use a long passphrase made from unrelated random words.
Why minimums and personal choices differ
A platform sets the minimum it is prepared to accept, while a user chooses a practical value above that floor. An account protected only by a password deserves a longer value than a low-risk account already protected by a strong phishing-resistant factor. The service must also store passwords safely and rate-limit guesses; users cannot evaluate security from length alone.
Examples that look long but remain weak
A repeated phrase, a keyboard walk or a personal sentence can be long without being unpredictable. Attackers test common constructions, leaked passwords and predictable substitutions before attempting a completely random search. Length helps most when the value was selected randomly or built from genuinely unrelated random words.
Compatibility and maximum length
Some older systems reject spaces or certain symbols. Use the longest value the service reliably accepts and document the restriction rather than shortening every password. Silent truncation is especially dangerous because the user may believe the full password is being checked when only an initial portion matters.
Action checklist
- Use a unique credential for every important account.
- Prefer long random passwords or unrelated-word passphrases.
- Store credentials in a reputable password manager.
- Enable passkeys, security keys or an authenticator app where available.
- Keep recovery details current and backup codes separate from the main device.
- Change credentials after suspected compromise and review active sessions.
Frequently asked questions
Does a complex password guarantee account security?
No. Phishing, malware, insecure recovery and compromised sessions can bypass a password.
Should I change passwords on a schedule?
What should I secure first?
Start with primary email, password manager, financial, work, cloud, domain and hosting accounts.
Standards and source notes
This page is maintained by the Password Tools Hub Editorial Team. General password guidance is checked against NIST SP 800-63B and the OWASP Authentication Cheat Sheet. Product interfaces can change; use the linked provider documentation for the final account action.