Twelve characters, done properly
Twelve random characters is where passwords become genuinely strong for online accounts. With all character types, each password has about 77 bits of entropy, which would take hundreds of thousands of years to search at ten billion guesses per second.
NIST’s current digital identity guidelines ask for at least 15 characters when a password is the only thing protecting an account. So 12 is a good fit when the account also has two-factor authentication, or when a system limits passwords to around 12 to 14 characters. Otherwise, use the 16-character password generator.
Making 12 work harder
- Keep symbols on if the site accepts them. They add about 6 bits compared with letters and digits alone.
- Turn on two-factor authentication wherever it is offered.
- Use a different password for every site. Reuse is a bigger risk than length.
Frequently asked questions
Is 12 characters long enough?
For a random password backed by two-factor authentication, yes. If the password is the only protection, 16 characters is the better choice.
How long would a 12-character password take to crack?
At ten billion guesses per second, searching half of the possibilities would take around 270,000 years. That assumes the password is truly random, as it is here.