How long should a random password be?
To reach at least 80 estimated bits, this model needs 18 lowercase letters, 14 characters using uppercase and lowercase letters plus numbers, or 13 printable ASCII characters.
Important: these comparisons are for passwords made with truly random characters, not passwords chosen by people.
How does the character set change the required length?
A larger character set creates more possible passwords at each length, so fewer characters are needed to reach the same target. The achieved estimate is shown in parentheses because whole-character lengths usually land slightly above the target.
| Target | Lowercase letters (26) | Uppercase, lowercase, and digits (62) | Printable ASCII characters (94) |
|---|---|---|---|
| 40 bits | 9 (42.30 bits) | 7 (41.68 bits) | 7 (45.88 bits) |
| 60 bits | 13 (61.11 bits) | 11 (65.50 bits) | 10 (65.55 bits) |
| 80 bits | 18 (84.61 bits) | 14 (83.36 bits) | 13 (85.21 bits) |
| 100 bits | 22 (103.41 bits) | 17 (101.22 bits) | 16 (104.87 bits) |
| 128 bits | 28 (131.61 bits) | 22 (130.99 bits) | 20 (131.09 bits) |
What changes at 80 estimated bits?
Moving from lowercase letters to all printable ASCII characters reduces the required length from 18 characters to 13 in this random-password model.
The table above contains the same values for keyboard and screen-reader access.
How did we calculate these figures?
We keep combination totals as exact whole numbers. When a report includes time estimates, we keep them as exact fractions of a second and use 31,557,600 seconds per year for the readable versions. Entropy estimates use length × log2(alphabet size) and assume every choice is random and equally likely. Minimum length is ceiling(target bits / log2(alphabet size)); achieved entropy can therefore be slightly above the target.
These are calculated examples, not tests of real attacks or specific hardware. The EFF word-length figures are different: they count every word in the published list.
Where did the information come from?
- NIST SP 800-63B-4, Appendix A: Strength of Passwords — explains why estimates for random passwords should not be applied to passwords people make up themselves.
- Release 1 data and calculation details — the three alphabet sizes, five targets, formula, and full set of results used here.
We calculated the minimum lengths and the values in the table and chart. NIST does not publish or endorse these particular comparison figures.
These numbers only work if each character is picked at random and every character in the alphabet has an equal chance of being used. Simply requiring a number or symbol does not make a human-chosen password equivalent to a random one.
NIST source: NIST Special Publication 800-63B-4: Authentication and Authenticator Management, published 2025-08-26; reviewed 2026-10-21.
Can you download or cite this data?
Yes. Download the complete release or the smaller CSV containing this comparison.
Suggested citation: “Generate My Password, Password Length vs. Complexity, release password-statistics-release-1-v1 (2026-10-21).”
Related research
See the time-model assumptions, compare random words, or use the custom password generator.