Why 8 Characters is No Longer Enough: The Science of Strong Passwords

For more than a decade, the standard advice for creating a password was "make it at least 8 characters long, with one number and one symbol." Today, cybersecurity experts emphatically warn that this old standard leaves your accounts highly vulnerable. The reason boils down to simple math and the exponential growth of computing power.

Brute-Force Computing Power

Hackers crack passwords using "brute-force" attacks—automated software that exhaustively guesses every single possible combination of characters until it finds a match. A standard consumer graphics card (GPU) can now guess over 10 billion passwords per second. Specialized server clusters can run trillions of hashes per second.

If you use an 8-character password containing only lowercase letters, there are roughly 208 billion possible combinations (26^8). A modern hacking rig can crack this in under 30 seconds.

Length Trumps Complexity

While adding symbols and numbers increases the pool of possible characters (a concept known as "entropy"), physically extending the length of the password has a much more profound mathematical impact.

• An 8-character password with upper/lowercase, numbers, and symbols: approx. 39 minutes to crack.
• A 12-character password using only lowercase letters: approx. 3 weeks to crack.
• A 16-character password using everything: roughly 1 billion years to crack.

The Magic Number: 16+ Characters

Modern security protocols recommend a minimum of 16 characters for critical accounts like banking, email, and password manager master keys. Because humans are terrible at coming up with truly random strings, you should rely entirely on a machine.

Using our Password Generator, you can instantly create cryptographically secure 16- to 128-character strings containing a maximal mix of letters, numbers, and symbols. Combine this with a reputable password manager, and your digital footprint becomes virtually impenetrable to brute-force attacks.