Guide

How long should a password be?

Longer, random passwords are usually safer than short passwords with predictable substitutions.

Password strength depends on length, randomness, and uniqueness. A long password made from random characters is much harder to guess than a short password with a few symbols added.

For most personal accounts, a password of at least 14 to 16 characters is a good baseline. Sensitive accounts can use longer passwords. The exact number matters less than avoiding predictable patterns and never reusing the same password across sites.

Length beats clever tricks

People often replace letters with symbols, such as a with @ or o with 0. Attackers know those patterns. A truly random longer password is better than a short password that looks complicated but follows a common formula.

The Password Generator can create a random password locally in your browser. Use a password manager to store it so you do not need to memorize every account password.

Password checklist

• Use a unique password for every important account.
• Prefer 14 or more characters when allowed.
• Avoid names, birthdays, teams, and keyboard patterns.
• Use two-factor authentication when available.
• Change passwords after a breach or suspected leak.

Passphrases

A passphrase can also be strong if it is long and not based on a common quote. Four or five unrelated words can be easier to type than a random symbol string, but it should still be unique and not reused.

The safest everyday setup is simple: a password manager, long unique passwords, and two-factor authentication for accounts that matter.