How many random characters reach 80 estimated bits?
In this calculation, the minimum is 18 lowercase letters, 14 characters using uppercase and lowercase letters plus numbers, or 13 printable ASCII characters.
Scope: 80 bits is a comparison target, not a universal password requirement. The figures only apply when every character is chosen randomly and independently.
How does the character set change the required length?
A larger character set creates more possible passwords at each length, so fewer characters are needed to reach the same target. The achieved estimate is shown in parentheses because whole-character lengths usually land slightly above the target.
| Target | Lowercase letters (26) | Uppercase, lowercase, and digits (62) | Printable ASCII characters (94) |
|---|---|---|---|
| 40 bits | 9 (42.30 bits) | 7 (41.68 bits) | 7 (45.88 bits) |
| 60 bits | 13 (61.11 bits) | 11 (65.50 bits) | 10 (65.55 bits) |
| 80 bits | 18 (84.61 bits) | 14 (83.36 bits) | 13 (85.21 bits) |
| 100 bits | 22 (103.41 bits) | 17 (101.22 bits) | 16 (104.87 bits) |
| 128 bits | 28 (131.61 bits) | 22 (130.99 bits) | 20 (131.09 bits) |
What changes at 80 estimated bits?
Moving from lowercase letters to all printable ASCII characters reduces the required length from 18 characters to 13 in this random-password model.
The table above contains the same values for keyboard and screen-reader access.
How did we calculate these figures?
We keep combination totals as exact whole numbers. When a report includes time estimates, we keep them as exact fractions of a second and use 31,557,600 seconds per year for the readable versions. Entropy estimates use log2(number of possible outcomes) and assume every choice is random and equally likely. Minimum length is ceiling(target bits / log2(alphabet size)); achieved entropy can therefore be slightly above the target.
These are mathematical comparisons, not measurements from real attacks or specific hardware.
Where did the information come from?
- NIST SP 800-63B-4, Appendix A: Strength of Passwords — explains why estimates for random passwords should not be applied to passwords people make up themselves.
- Release 1 data and calculation details — the three alphabet sizes, five targets, formula, and full set of results used here.
We calculated the minimum lengths and the values in the table and chart. NIST does not publish or endorse these particular comparison figures.
These numbers only work if each character is picked at random and every character in the alphabet has an equal chance of being used. Simply requiring a number or symbol does not make a human-chosen password equivalent to a random one.
NIST source: NIST Special Publication 800-63B-4: Authentication and Authenticator Management, published 2025-08-26; reviewed 2026-10-21.
Can you download or cite this data?
Yes. Download the complete release or the smaller CSV containing this comparison.
Suggested citation: “Generate My Password, Password Length vs. Complexity, release password-statistics-release-1-v1 (2026-10-21).”
Related statistics
See the fixed-rate guessing-time estimates, compare random passphrase combinations, or use the custom password generator.