Password Generator 16 Characters: Is 8, 12 or 16 Enough?

For a password generator, 16 characters is the right default today. A random 16-character password made of letters, numbers and symbols is far beyond what attackers can guess, and it meets the US NIST guideline of at least 15 characters for accounts protected only by a password. Twelve random characters is still decent, especially with two-factor authentication; eight is no longer enough on its own. Make one with our password generator, which defaults to 16 characters and creates the password on your device.

Below is the maths behind those numbers, and when a passphrase of words is the better choice.

8 vs 12 vs 16 characters: the numbers

Password strength is measured in bits of entropy: each extra bit doubles the number of guesses needed. For a truly random password, entropy is the length multiplied by the bits per character, which depends on how many different characters are possible.

Our generator uses 80 characters when all four sets are on (uppercase, lowercase, digits and symbols, with look-alikes such as 0/O and 1/l removed). That gives about 6.3 bits per character:

The generator shows this figure under each password, labelled weak, fair, strong or very strong.

What the numbers mean in practice:

• Each extra character multiplies the work by 80. Going from 12 to 16 characters makes the password 80⁴, roughly 41 million times, harder to brute-force.
• 8 characters (about 50 bits) can be within reach of a well-equipped attacker who has stolen a database of password hashes, especially if the site used a fast hash.
• 12 characters (about 75 bits) is out of reach for brute force with current hardware in most scenarios.
• 16 characters (about 100 bits) leaves a huge margin, including for future hardware and weak storage on the site's side.

These figures only hold for random passwords. A 16-character password like Rahul@1234567890 has a fraction of this strength because it follows a pattern attackers try first.

Why length beats complexity

Adding symbols to the character set raises each character from about 5.8 bits (letters and digits) to 6.3 bits. Adding one more character adds a whole 6 bits. So:

• 16 random letters and digits (about 93 bits) is stronger than 12 random characters with symbols (about 76 bits).
• If a site rejects symbols, untick them and add two or three characters.

This is why NIST's current guidance (SP 800-63B revision 4, finalised in 2025) drops "must contain a symbol" rules and instead sets a minimum of 15 characters where a password is the only factor, and 8 where it is combined with another factor such as an OTP. Our guide on creating a strong password covers the rest of that guidance.

When to use 12, 16 or more

Your email account deserves the strongest password, because it can reset all the others.

Passwords you can say and type: passphrases

Random characters are best for passwords stored in a password manager, which types them for you. For the few you must type or remember (your phone's password manager master password, your computer login, a Wi-Fi password you read out to guests), a passphrase of random words is easier:

timber-velvet-ankle-orbit-mango-flute

The strength comes from the words being chosen at random from a large list, not from the words themselves. With the widely used EFF list of 7,776 words (the "diceware" method, where you roll five dice per word), each word adds about 12.9 bits:

Six random words is comparable to a 12-character random password and far easier to type on a phone. A famous quote, song line or "ilovemycat" is not random and gives almost no protection.

Our password generator makes character passwords, not word-based ones. To make a passphrase:

• Use the passphrase option in a password manager (Bitwarden, 1Password and others have one), or
• Roll real dice with the EFF word list, or
• Pick words by truly random means; do not choose words you like.

"Easy to say" and "easy to read" passwords

Some generators offer modes that avoid confusing characters. Ours always leaves out look-alikes like 0/O and 1/l/I, so passwords are easier to read and copy by hand without losing much strength.

How to use the generator

1. Open the password generator.
2. Set the length with the slider (6 to 64; 16 is the default).
3. Tick the character types the site allows.
4. Check the entropy label underneath.
5. Click Copy and paste it into the site and your password manager.

Passwords are generated with the browser's secure random generator (crypto.getRandomValues) and are never sent anywhere. The generator makes one password at a time; click Generate new for another.

What the site does with your password matters too

Your password's strength protects you best when the site stores it properly, with a slow, salted hash. You cannot control that, which is another reason for length: a long random password survives even a leak from a site that used a fast hash such as plain SHA-256. (Curious what a hash looks like? Try the SHA-256 hash generator, and see our guide on checking SHA-256 hashes.)

Common mistakes

• Making a long password from a pattern, like a name plus a year plus "@". Length only helps if the characters are random.
• Reusing a strong password. If one site leaks it, every account with it is exposed. Use a different password for every site.
• Choosing passphrase words yourself. People pick related, common words. Use dice or a generator.
• Writing down a 16-character password on a sticky note on the screen. Use a password manager instead.
• Skipping two-factor authentication because the password is long. Phishing captures long passwords just as easily.

Questions