How Long Should a Password Be? The Real Answer, With the Math
Password strength is usually measured in bits of entropy — a way of expressing how many possible combinations an attacker would have to try before guessing correctly. It's calculated as length × log2(pool size), where "pool size" is how many different characters could appear in each position.
What the numbers actually mean
| Entropy | Practical strength |
|---|---|
| Under 50 bits | Weak — crackable in a realistic timeframe with modern hardware |
| 50–70 bits | Moderate — fine for low-value accounts |
| 70–90 bits | Strong — solid for most personal accounts |
| 90+ bits | Very strong — appropriate for sensitive accounts like email or banking |
Keysmith calculates this for you in real time as you adjust the length slider, so you can see exactly where a password lands before you use it.
Why length matters more than symbols
Adding one more character to a password multiplies the number of possible combinations — it doesn't just add to it. That's why a longer password made only of letters and numbers is often stronger than a short one stuffed with symbols. Length has a bigger effect than character variety.
A practical minimum
- 12 characters — the realistic floor for any account you actually care about.
- 16 characters — a comfortable default for most personal and work accounts.
- 20+ characters — worth it for email, financial accounts, or anything that could unlock other accounts if compromised.
Since a password manager fills these in for you, there's rarely a good reason to keep them short — the "hard to type" problem disappears once you're not the one typing it.
Ready to put this into practice? Keysmith generates cryptographically secure passwords locally in your browser — nothing is ever sent to a server.
Generate a Secure Password