10 character password
Ten characters is a common form requirement, but by current standards it is already modest. Where it suffices and where it does not.
Space — new password · C — copy · M — hide
Password length
Character sets
Select at least one character set.
Passphrase settings
A 2048-word list gives exactly 11 bits per word (the Diceware method). Six words are 66 bits, eight are 88. The words are drawn by a cryptographic generator, not by a human — that is the whole point.
Password pattern
a — lowercase, A — uppercase, L — any letter, 9 — digit, # — symbol, X — letter or digit, * — any enabled character, c/v — consonant/vowel. Every other character is copied as is, \ escapes the next one.
Fine tuning
“Safe symbols only” keeps !@#$%^&*_-+=? — almost every site accepts them and they do not break shell commands, CSV or SQL.
Recent passwords (this tab only)
What happens to your password
The password is assembled in your browser from the cryptographic randomness source crypto.getRandomValues with rejection sampling, so every character is equally likely.
The page never sends passwords to a server, never writes them to browser storage and drops the history when the tab closes.
Password letter by letter
Phonetic spelling for reading a password out over the phone. Letter case is stated separately.
What ten characters give you
Ten random characters from the full set are about 65 bits. Through a login form such a password will never be guessed: hundreds of attempts per second, and the first lockout ends it.
Offline against a stolen hash database is another matter. There the count runs to tens of billions per second, and sixty-five bits is roughly two months of work for one graphics card.
So: enough for a forum or a one-off sign-up. Not enough for email, banking or anything holding money or documents.
Why forms ask for exactly ten
The number is inherited from requirements written when a cracker checked a thousand candidates per second. Speed has grown a millionfold since; the form minimum has not.
A minimum is a floor, not advice. If the form allows more, take more: sixteen characters are no harder to use when the password lives in a manager.
Questions
Frequently asked questions
Is a 10 character password strong enough?
It depends what against. Online guessing through a login form it survives easily. But offline against a stolen hash database, ten random characters give about 65 bits — roughly two months of work for one graphics card.
Why do sites ask for exactly ten?
The number is inherited from older requirements and rarely updated. A minimum is a floor, not a recommendation.
What to use instead?
Sixteen characters wherever the password lives in a manager: the inconvenience is zero and cracking stops being a threat entirely.
Next