16 character password
Sixteen characters is what to use by default everywhere. Decades of margin at the cost of a few extra seconds once.
Space — new password · C — copy · M — hide
Password length
Character sets
Select at least one character set.
Passphrase settings
A 2048-word list gives exactly 11 bits per word (the Diceware method). Six words are 66 bits, eight are 88. The words are drawn by a cryptographic generator, not by a human — that is the whole point.
Password pattern
a — lowercase, A — uppercase, L — any letter, 9 — digit, # — symbol, X — letter or digit, * — any enabled character, c/v — consonant/vowel. Every other character is copied as is, \ escapes the next one.
Fine tuning
“Safe symbols only” keeps !@#$%^&*_-+=? — almost every site accepts them and they do not break shell commands, CSV or SQL.
Recent passwords (this tab only)
What happens to your password
The password is assembled in your browser from the cryptographic randomness source crypto.getRandomValues with rejection sampling, so every character is equally likely.
The page never sends passwords to a server, never writes them to browser storage and drops the history when the tab closes.
Password letter by letter
Phonetic spelling for reading a password out over the phone. Letter case is stated separately.
Why sixteen and not twenty
Sixteen characters from the full set is around 105 bits. A farm testing 10¹⁴ candidates per second would need longer than the universe has existed. Twenty characters give 131 bits — also longer than the universe has existed.
The difference between “impossible” and “impossible” has no practical meaning. Sixteen characters, however, are accepted by almost every system, while twenty-four start hitting the limits of old forms.
So sixteen is the point where strength stops being the constraint and compatibility has not yet become one.
Length against character sets
A common misconception: to strengthen a password you should add punctuation. Length works far harder.
Sixteen lowercase letters give 75 bits. Eight characters from all sets, with capitals, digits and symbols, give 52. A boring long password beats a short “complex” one by three orders of magnitude.
Symbols help, but as an addition to length rather than a substitute. And if a site refuses them, simply take one without and add a couple of characters.
Questions
Frequently asked questions
Why is 16 the recommendation?
Around 105 bits of entropy. Even a farm testing 10¹⁴ candidates per second would need longer than the universe has existed. Going further changes nothing in practice while typing gets harder.
Is that not excessive?
Not if you keep passwords in a manager: you paste them rather than type them. Length only costs you where it is typed by hand, and for that there are passphrases.
What matters more, length or symbols?
Length. Sixteen lowercase letters give 75 bits; eight characters from all sets give 52. Adding four characters beats adding an exclamation mark.
Next