How Long Should a Password Be?
Practical guidance on password length, random passwords, passphrases, and why uniqueness matters more than clever substitutions.
Length is useful, but randomness matters
Adding characters usually increases the number of possibilities when those characters are selected unpredictably. A long, familiar quote or keyboard pattern may be easier to guess than a shorter truly random string. Never assume length alone guarantees security.
A practical default for generated passwords
When a website permits it and you store passwords in a password manager, a unique 20-character randomly generated password is a strong, convenient default. Some services impose length or character restrictions; follow their supported limits without falling back to reused passwords.
What about passwords you memorize?
Consider a passphrase made from multiple words selected independently at random. Five words chosen uniformly from a 2,048-word list have 55 bits of selection entropy under those exact assumptions. Choosing your own words or adding predictable substitutions does not provide the same estimate.
Do symbols and numbers help?
They can, when included through genuinely random selection. Appending “123!” to a familiar word is predictable. For an account password, unpredictability, uniqueness, and safe storage matter more than meeting an arbitrary visual complexity rule.
Account security is broader than password length
Use a different credential for every site, enable multi-factor authentication or passkeys where offered, keep your devices updated, and watch for phishing. A strong password cannot prevent every type of account compromise.
Try it yourself
Generate a new random password or passphrase with SecurePassLab.
Open the free password generator →Related reading: All password security guides.