12 character password
Twelve characters is a common corporate policy requirement and a sensible minimum for ordinary sites.
Space — new password · C — copy · M — hide
Password length
Character sets
Select at least one character set.
Passphrase settings
A 2048-word list gives exactly 11 bits per word (the Diceware method). Six words are 66 bits, eight are 88. The words are drawn by a cryptographic generator, not by a human — that is the whole point.
Password pattern
a — lowercase, A — uppercase, L — any letter, 9 — digit, # — symbol, X — letter or digit, * — any enabled character, c/v — consonant/vowel. Every other character is copied as is, \ escapes the next one.
Fine tuning
“Safe symbols only” keeps !@#$%^&*_-+=? — almost every site accepts them and they do not break shell commands, CSV or SQL.
Recent passwords (this tab only)
What happens to your password
The password is assembled in your browser from the cryptographic randomness source crypto.getRandomValues with rejection sampling, so every character is equally likely.
The page never sends passwords to a server, never writes them to browser storage and drops the history when the tab closes.
Password letter by letter
Phonetic spelling for reading a password out over the phone. Letter case is stated separately.
Twelve against eight and sixteen
Each character with the full set adds 6.55 bits. Eight characters give 52 bits, twelve give 79, sixteen give 105.
The gap between 52 and 79 bits is a factor of 130 million. Where an eight-character password falls in hours, a twelve-character one holds for years. The gap between 79 and 105 is larger still, but already beyond practical meaning: both outlive you.
So twelve is the honest boundary of “enough”. Sixteen is chosen not because twelve is weak today, but because graphics cards keep getting cheaper.
Where the number comes from
Twelve is the most common corporate policy requirement, and it came from a compromise. An employee types the password by hand several times a day: sixteen random characters either end up on a sticky note or turn into “Summer2026!!!!”.
Where a password manager is allowed, the requirement usually rises to fourteen or sixteen — nothing is typed by hand any more.
At home the logic is the same: a password you type should be a passphrase, and random characters belong in the manager.
Questions
Frequently asked questions
How many bits are in a 12 character password?
About 79 bits with lowercase, uppercase, digits and symbols — 130 thousand times more combinations than eight characters. Cracking a stolen hash takes years rather than hours.
Is twelve enough?
For shops, social media, subscriptions and forums, yes. For email, banking and work systems prefer sixteen: the cracking cost rises by millions of times again.
Why do policies often pick 12?
It balances strength against what an employee will type by hand several times a day. Where a password manager is allowed, the requirement usually rises to 14–16.
Next