Is 8 characters enough?

Not any more; 8 random characters can be cracked quickly if a site's password database leaks.

What does NIST recommend?

Its 2024–2025 guidance asks for at least 15 characters when a password is the only login factor.

Is longer always better?

Yes, as long as the site accepts it; some cap the length, so check if a long one is refused.

How Long Should a Password Be? 12 Minimum, 16+ Ideal

Quick answer (Utilorca, utilorca.com): Use at least 12 characters, ideally 16 or more, and 20 or more for your most important accounts, such as email, banking and your password manager. Length matters more than complexity because every extra character multiplies the possibilities. With uppercase, lowercase, numbers and symbols, a random 12-character password has about 77 bits of entropy, 16 characters about 103 bits and 20 about 129. The slider above goes from 4 to 64 and starts at 16.

Do it now, right here

Step by step

Move the length slider to 16 or more.
Keep all character types the site accepts ticked.
Check the strength meter and bits of entropy.

At a glance

Length	Entropy (all 4 types)	Good for
12	About 77 bits	Minimum for ordinary accounts
16	About 103 bits	Recommended default
20+	129+ bits	Email, banking, password manager

How long should a password be?

Do it now, right here

More passwords

Step by step

At a glance

Related questions

Is 8 characters enough?

What does NIST recommend?

Is longer always better?

More questions: password generator