“At least eight characters” sits in half the registration forms on the internet. The number comes from recommendations written in the nineties and has not moved since, while cracking speed has grown by a factor of millions.
Where the years come from
Every character you add multiplies the number of candidates by the size of the alphabet. For the full set of 94 printable characters that is a multiplication by 94 — one character adds more than any amount of complicating the ones already there.
| Length | Entropy | Offline, 10¹⁰/s | Farm, 10¹⁴/s |
|---|---|---|---|
| 8 | 52 bits | a few hours | seconds |
| 10 | 65 bits | about two months | a few minutes |
| 12 | 79 bits | hundreds of thousands of years | decades |
| 14 | 92 bits | billions of years | hundreds of thousands of years |
| 16 | 105 bits | longer than the universe has existed | longer than the universe has existed |
| 20 | 131 bits | not worth calculating | not worth calculating |
One character versus the whole alphabet
A common argument: is it better to add special characters or to add length? The arithmetic answers plainly.
Widen the alphabet
- From 26 letters to 94 characters: +1.85 bits per character
- The password becomes harder to type
- Some forms reject symbols outright
- Reading it aloud becomes near impossible
Add a character
- Each character: +6.55 bits with the full set
- Typing does not get qualitatively harder
- Works in any form
- One character is worth more than the entire alphabet widening
What to use in practice
- 16 characters — a sensible default for anything that lives in a manager. Ready page.
- 20 and up — email, banking, the password manager itself. You type them rarely and they are worth more than the rest.
- 32 and up — keys, tokens and service accounts that a program supplies.
- 12 — the floor below which not to go when the form allows more.
- 8 — only when the system refuses anything longer. Then a second factor is mandatory.
If a form caps the length at twelve characters, that usually means the password is not stored well — and a reason never to reuse it anywhere else.