8 character password
Eight characters is the lowest length sites still accept and already too little for anything that matters. The generator makes the best eight-character password possible; below is where it is still acceptable.
Space — new password · C — copy · M — hide
Password length
Character sets
Select at least one character set.
Passphrase settings
A 2048-word list gives exactly 11 bits per word (the Diceware method). Six words are 66 bits, eight are 88. The words are drawn by a cryptographic generator, not by a human — that is the whole point.
Password pattern
a — lowercase, A — uppercase, L — any letter, 9 — digit, # — symbol, X — letter or digit, * — any enabled character, c/v — consonant/vowel. Every other character is copied as is, \ escapes the next one.
Fine tuning
“Safe symbols only” keeps !@#$%^&*_-+=? — almost every site accepts them and they do not break shell commands, CSV or SQL.
Recent passwords (this tab only)
What happens to your password
The password is assembled in your browser from the cryptographic randomness source crypto.getRandomValues with rejection sampling, so every character is equally likely.
The page never sends passwords to a server, never writes them to browser storage and drops the history when the tab closes.
Password letter by letter
Phonetic spelling for reading a password out over the phone. Letter case is stated separately.
How long it lasts
Eight characters from all four sets is 94⁸ combinations, about 52 bits. Impressive as a number, but what matters is time, not combinations.
Against a login form where the server limits attempts to a hundred per second, brute force would take thousands of years, and such a password holds. But once a hash database leaks, the attacker works offline on their own graphics cards at tens of billions of attempts per second. The same 52 bits become a few hours, or minutes on a rented farm.
Leaks happen regularly, so assume the worst case: sooner or later the password ends up in someone else’s hash database.
When eight is enough
One-off sign-ups. A forum to ask a single question; a service you will use twice. There is nothing valuable behind such an account.
When the site allows no more. Old banking systems and corporate portals still do this. Then enable every character set, never reuse the password and add a second factor.
Where eight is never enough: email, banking, your password manager, work accounts. They are the recovery path to everything else and need sixteen.
Questions
Frequently asked questions
How strong is an 8 character password?
Around 52 bits of entropy with all four character sets. Offline on a GPU that is hours; on a modern farm, minutes. Against a login form with attempt limits it still holds; against a stolen hash database it does not.
Why do sites demand exactly 8?
It is a leftover from guidance written twenty years ago, when cracking ran on CPUs at thousands of attempts per second. The same number means something very different today, but the requirement stayed.
What if the site allows no more than eight?
Use every character set, never reuse that password anywhere else and switch on two-factor protection — it compensates for the short length.
Next