Password Requirements Across 100 Popular Services

Eight characters remains the most common published minimum

Twenty services published an exact minimum: 14 used eight characters, three used six, two used ten, and one required more than ten. The other 80 were either undocumented in the sources we found or not applicable to the current login flow.

Examples include GitHub's conditional 8-or-15-character rule, npm's requirement for more than 10 characters, and GitLab.com's 8-to-128-character range.

Maximum lengths are rarely published

We found an exact maximum for seven services. Three capped passwords at 20 characters; the other published limits were 60, 72, 99, and 128. The remaining 93 services did not provide a usable maximum, or the field was not part of the current login flow.

That distinction matters. A missing maximum in this dataset is not evidence that a site accepts passwords of any length.

Passkeys are visible, but coverage varies sharply by sector

Thirty-seven services documented passkey sign-in. The highest count was in productivity and cloud services, where eight of ten had a public passkey page. Streaming media had no confirmed passkey entries in this sample.

Password-manager and breach-screening disclosures are uncommon

Sixteen services explicitly supported or recommended password managers in the official pages we reviewed. Ten disclosed checks against common, weak, or breached passwords. These are disclosure counts, not implementation rankings: a service may support either control without publishing it.

Examples of explicit screening disclosures include GitHub, Canva, and Atlassian accounts used by Bitbucket.

How was the study done?

We froze a purposive sample of 100 recognizable services across 10 sectors before collection. This is not a traffic ranking or a random sample of the web. We reviewed official help pages, account documentation, and password fields visible without creating or changing an account. We did not submit registration forms, test real passwords, bypass bot defenses, or use anyone's account.

Each record went through a collection pass and a separate evidence-review pass. The review removed claims based only on advice, kept conflicting sources visible, and marked unsupported controls as unknown. Collection and review were completed by the same researcher; this release has not been independently replicated.

Thirteen services were marked not testable because no suitable official source was accessible within the collection boundary. Unknown and not-applicable values stay in every denominator.

The control definitions and collection rules are available in the data dictionary and study notes.

Sources for all 100 services

Every number above comes from the reviewed records below. The source links open the official pages used for that service. A dash means no suitable official page was found within the study boundary.

Download and cite the data

The JSON includes every source title, URL, access date, paraphrase, account context, note, and normalized control. The CSV is easier to analyze in a spreadsheet.

Suggested citation: “Generate My Password, Password Requirements Across 100 Popular Services, release website-password-requirements-2026-v1 (2026-10-22).”

Related statistics

Compare random password length and search space, review fixed-rate password guessing estimates, or see random passphrase combinations.