When security teams write password policies, they almost always emphasize complexity: at least one uppercase letter, one number, one symbol. But modern cryptographic research tells a different story. Length is the dominant factor in password security — a 20-character password of all lowercase letters is mathematically stronger than a 10-character password that mixes all four character classes. Understanding why this is true changes how you approach every password you set.
Why Length Beats Complexity
Password strength is measured in bits of entropy — a value representing how many guesses would be required, on average, to crack a password by trying every possibility. Entropy depends on two variables: the size of the character pool and the total length. Doubling the length adds more entropy than expanding the character pool, because entropy scales multiplicatively with length but only additively with pool size.
Consider two passwords: "P@ssw0rd!" (9 characters, all four character classes) and "purple-mountain-lake-27" (22 characters, lowercase letters, hyphens, and digits). The first follows classic complexity rules but has roughly 54 bits of entropy. The second has over 120 bits of entropy — more than twice as much, and practically uncrackable with any foreseeable hardware.
Short, complex passwords also fail against hybrid dictionary attacks — automated tools that combine word fragments, common letter-to-number substitutions (a→@, o→0, e→3), and appended symbols in predictable patterns. Most "complex" human-chosen passwords follow these patterns, which is why password crackers test them first. A longer random password has no pattern to exploit.
What NIST SP 800-63B Says
The US National Institute of Standards and Technology revised its digital identity guidelines in 2024. The revision explicitly moved away from mandatory complexity requirements and focused on length. NIST recommends a minimum of 8 characters for user-chosen passwords but strongly encourages allowing passwords up to at least 64 characters, with no maximum that would prevent passphrases.
NIST also recommends against forced periodic password resets unless there is evidence of compromise. Users required to change passwords regularly tend to make predictable incremental changes — Password1, Password2, Password3 — providing minimal security improvement while degrading usability. A long, genuinely random password that never needs to be remembered is safer than one that rotates frequently.
The guidelines explicitly warn against complexity requirements that restrict entropy in counterproductive ways — such as prohibiting spaces (which prevents passphrases), enforcing maximum lengths below 64 characters, or requiring specific character class combinations that produce shorter passwords with predictable structures.
Recommended Lengths by Use Case
For standard online accounts — social media, email, e-commerce — 16 characters is a practical minimum that provides approximately 105 bits of entropy when all four character classes are used. At that entropy level, brute-force attacks are computationally infeasible with current hardware. A length of 20 to 24 provides additional headroom as computing power increases.
For high-value accounts — banking, investment portals, healthcare systems, work accounts with sensitive access — 24 characters or more is the appropriate target. These are accounts where a breach has significant real-world consequences. The slight inconvenience of a longer password stored in a password manager is a trivial trade-off for the additional security margin.
For password manager master passwords — the one credential that protects all others — 32 characters or a passphrase of four to five random words with separators is reasonable. The master password cannot be stored anywhere, so memorability matters. A passphrase like "correct-horse-battery-staple-7" is 30 characters, easy to remember, and has far more entropy than a complex 12-character password.
Generate a random password at any length from 8 to 128 characters — with full control over character sets and ambiguous character exclusion.
Open the Password Generator →The practical takeaway is straightforward: use a password generator set to at least 16 characters for everyday accounts, at least 24 for high-value accounts, and a passphrase of 32 or more characters for your password manager master password. Complexity options — uppercase, lowercase, numbers, symbols — still matter because they expand the character pool and add entropy per character. But length is the engine; character variety is the multiplier. Maximize length first, then ensure character diversity.