How long should a password be? Length, words and entropy

For years people were told to make passwords with a capital letter, a number and a symbol, and to change them every month. The result was passwords like Summer2026! that are easy for people to forget and easy for attackers to guess. Current advice from the UK's National Cyber Security Centre is different: choose something long and hard to guess, such as three random words, and use a different one for every account. This guide explains why length matters more than clever substitutions, shows the arithmetic of how many guesses a password takes to crack, compares a short complex password with a long simple one, explains how to use three random words well, and covers the other habits that protect an account, such as a password manager and two-step verification.

By Valtrinity. Updated 18 October 2026.

Why length beats complexity

A password's strength comes from how many possibilities an attacker has to try. Each extra character multiplies the number of possible passwords. Adding complexity, such as capitals and symbols, increases the pool of characters a little. Adding length multiplies the work every time.

Take a password made only of lowercase letters. Each character has 26 options. An 8-character password has 26 to the power 8 possibilities, which is about 209 billion. A 12-character one has 26 to the power 12, which is about 95 quadrillion, around 450,000 times more.

Now use 94 printable characters, including capitals, digits and symbols. An 8-character password has 94 to the power 8, which is about 6 quadrillion possibilities. So adding all the complexity to 8 characters gives about 6.1 quadrillion, while 12 lowercase letters gives 95 quadrillion. Four more characters beat all the extra symbols, and are easier to type and remember.

Entropy: a measure of unpredictability

Security people measure this in bits of entropy. Each bit doubles the number of possibilities. The formula for a password made by picking characters at random is the length times log base 2 of the size of the character set. For 12 lowercase letters, that is 12 times 4.7, which is about 56 bits. For 8 characters from 94, it is 8 times 6.55, about 52 bits.

For a passphrase made by picking words at random from a list, each word adds log base 2 of the list size. A list of 2,000 words gives about 11 bits a word, so three words give about 33 bits, four give 44, and six give 66 bits. A longer list or more words adds more.

These numbers only hold if the choice is truly random. Human choices are predictable. If you pick words because they mean something to you, such as your pet and your birthday, the real entropy is far less than the figures suggest, because attackers try those first.

How fast can a password be guessed?

The speed of an attack depends on how the service stores passwords and on whether the attacker has copied the data. If the attacker can only try passwords against the login page, services slow them down or lock the account after a few attempts, so the number of guesses is small. If the attacker has stolen a database of password hashes and is trying guesses offline, the speed can be billions of guesses a second on powerful hardware for weak storage methods, and much less for strong ones.

At 10 billion guesses a second, 26 to the power 8 possibilities, about 209 billion, take about 21 seconds to run through. 12 lowercase letters take 95 quadrillion divided by 10 billion, which is 9.5 million seconds, about 110 days. A random 16-character lowercase password would take about 457,000 times longer than that, which is well over a hundred thousand years at the same speed.

These are illustrations, not guarantees. They show that a few extra characters move the answer from seconds to months to centuries, and that length is the cheapest way to add strength.

Three random words

The NCSC recommends combining three random words to make a password. The result is long, which gives strength, and it is easier to remember than a jumble of characters. An example is 'copper lantern bicycle', typed with or without spaces.

The words must be random, not a phrase from a song, a quotation or something connected with you. Avoid famous combinations and avoid choosing words that are close together in meaning. A generator that picks words from a large list is better than your own imagination. If you want more strength, use four or five words, or add a number or a symbol in the middle for services that insist on one.

Three words may still be too weak for the most valuable accounts, such as your main email, which can be used to reset others. Use a longer passphrase there, and turn on two-step verification.

What to avoid

Do not use personal details such as names, birthdays, addresses or your favourite team. Attackers can find these easily, and tools that guess passwords start with them. Do not use common passwords and patterns: password, qwerty, 123456, or the previous password with a 1 at the end.

Do not reuse a password. When one service is breached, attackers try the same email and password on other sites. This is called credential stuffing, and it is one of the most common ways accounts are taken over. A different password for each account limits the damage.

Do not rely on substitutions such as @ for a, 0 for o or 3 for e. Attackers' tools include these tricks, so they add very little strength. Do not write passwords on a note stuck to a monitor or share them in messages.

Password managers and two-step verification

Nobody can remember dozens of long, unique passwords. A password manager can create and store them for you, so you only remember one strong passphrase to unlock it. Your browser or phone may have one built in. Choose a method you will actually use, and protect it with a long passphrase and two-step verification.

Two-step verification asks for something in addition to your password, such as a code from an authenticator app, a prompt on your phone, or a physical key. It means a stolen password alone is not enough. Turn it on for email, banking, shopping and social accounts first. Text message codes are better than nothing, but an app or a key is stronger.

Check whether your email address has been in a known data breach using a breach-notification service, and change the password on any affected account and anywhere you reused it.

A simple plan

Use a password manager to create a random password of 16 characters or more for most accounts. For the few you must type often, such as your device login and the manager itself, use a passphrase of four or more random words.

Turn on two-step verification where it is offered. Keep a recovery method up to date, and store backup codes somewhere separate, such as on paper in a drawer at home.

Change a password when you have a reason, such as a breach or a suspicion, not on a fixed schedule. A strong, unique password that stays the same is better than a weak one that changes every month.

Tools mentioned in this guide

Frequently asked questions