15 character password
Fifteen characters is already the length where brute force stops making sense. A good choice when the form will not take more.
Space — new password · C — copy · M — hide
Password length
Character sets
Select at least one character set.
Passphrase settings
A 2048-word list gives exactly 11 bits per word (the Diceware method). Six words are 66 bits, eight are 88. The words are drawn by a cryptographic generator, not by a human — that is the whole point.
Password pattern
a — lowercase, A — uppercase, L — any letter, 9 — digit, # — symbol, X — letter or digit, * — any enabled character, c/v — consonant/vowel. Every other character is copied as is, \ escapes the next one.
Fine tuning
“Safe symbols only” keeps !@#$%^&*_-+=? — almost every site accepts them and they do not break shell commands, CSV or SQL.
Recent passwords (this tab only)
What happens to your password
The password is assembled in your browser from the cryptographic randomness source crypto.getRandomValues with rejection sampling, so every character is equally likely.
The page never sends passwords to a server, never writes them to browser storage and drops the history when the tab closes.
Password letter by letter
Phonetic spelling for reading a password out over the phone. Letter case is stated separately.
Fifteen versus sixteen
Fifteen random characters from the full set are about 98 bits. Sixteen give 105. The difference exists on paper and means nothing in practice: both take longer to crack than the universe has existed.
Sixteen is recommended more often simply because a round number is easier to remember as a rule.
Where this length is the ceiling
A fifteen-character cap turns up in older banking systems and corporate portals. It usually signals that the password is not stored well: modern storage does not limit length.
What to do: take the maximum allowed, enable a second factor and never reuse that password.
Questions
Frequently asked questions
Is fifteen characters enough?
Yes. Fifteen random characters from the full set give about 98 bits. At any conceivable speed, cracking takes longer than a human lifetime by an enormous margin.
Why is sixteen recommended then?
A round number is easier to remember as a rule. There is no practical difference — take whatever the form accepts.
When do you need more?
When a program supplies the password and nobody types it: thirty-two characters and up for keys and service accounts.
Next