Password rules have changed. The old advice — eight characters with an uppercase letter, a number and a symbol, changed every 90 days — produced passwords that were hard for people to remember and easy for computers to guess. The current US standard for authentication, NIST SP 800-63B (revision 4), says length matters most, forbids forcing mixtures of character types, and forbids forced periodic changes.
Why length wins, in numbers
How long a password survives depends on how many possibilities an attacker must try. Every extra character multiplies that number; a bigger alphabet helps much less. The table assumes a random password, and an attacker who has stolen a database of weakly hashed passwords and tries a hundred billion guesses per second — roughly what one high-end graphics card manages against fast hash functions. "Time" is the average to find it.
| Password | Possibilities (bits) | Average time to crack |
|---|---|---|
| 8 characters, letters and digits | 47.6 | about 18 minutes |
| 8 characters, all types | 50.6 | about 2 hours |
| 12 characters, all types | 75.9 | about 11,000 years |
| 16 lowercase letters only | 75.2 | about 7,000 years |
| 16 characters, all types | 101.2 | far longer than the age of the universe |
Two rows tell the story. Sixteen lowercase letters are about as strong as twelve characters of every type, and adding four more characters to an all-types password (12 → 16) is worth vastly more than any substitution trick. Services that store passwords properly, with slow hashes like bcrypt or Argon2, make every guess thousands of times more expensive — but you can't know how a given site stores yours.
The numbers only hold for random passwords. A password built from a word, a name or a date falls to dictionary attacks in seconds, however long it is, because attackers try the likely ones first.
What NIST SP 800-63B now says
From the final revision 4 text, for services:
- Passwords used on their own must be at least 15 characters; at least 8 when they are one factor of several.
- Services should allow at least 64 characters, including spaces.
- They shall not impose composition rules such as "one uppercase, one symbol".
- They shall not require periodic changes — only when there is evidence the password was compromised.
- They shall check new passwords against a list of common and previously breached ones.
How our generator works
Password Generator builds passwords from up to four groups — 26 lowercase letters, 26 uppercase, 10 digits and 18 symbols (! @ # $ % ^ & * ( ) - _ = + [ ] { }), 80 characters in all — with a length from 6 to 48, 16 by default.
- Randomness comes from crypto.getRandomValues, the operating system's cryptographically secure generator, not Math.random.
- Each character is chosen with rejection sampling, so no character is slightly more likely than another — a subtle bias that the simpler "random number modulo 80" method introduces.
- Every group you tick is guaranteed to appear at least once (many sites demand it), and the characters are then shuffled so that guaranteed character isn't always in the same position.
- The password is generated in the page. It is never sent anywhere, and it disappears when you close the tab — copy it into your password manager first.
Passphrases
For the few passwords you have to type or remember — your computer login, your password manager's master password — a passphrase of random words is easier than a random string. Six words picked at random from a 7,776-word list give about 77 bits, as strong as a random 12-character password. The words must be chosen by dice or a generator, not by you: a phrase you invented, or a famous quote, is in an attacker's dictionary.
Three habits that matter more than any single password
- A different password for every site. Most account takeovers use a password leaked from another site.
- A password manager, so length and uniqueness cost you no effort.
- Two-factor authentication on email, banking and anything that can reset other accounts. An authenticator app or a passkey is stronger than an SMS code.