When eight characters is all you get
Some routers, legacy business systems and older devices cap passwords at eight characters. When that is the rule, the best you can do is make all eight fully random, using every character type the system accepts.
With letters, digits and symbols, an 8-character random password has about 52 bits of entropy. That is enough for a login protected by attempt limits, but it can be cracked offline if the password hash leaks. If the system allows longer passwords, use 16 characters instead.
Get the most out of eight
- Keep every character type on. Dropping symbols cuts strength to about 48 bits.
- Turn on two-factor authentication if the system supports it.
- Change the password right away if the device or service reports a breach.
Frequently asked questions
Is an 8-character password secure?
A random one is acceptable for online logins with lockouts. It is not enough for anything that can be attacked offline, such as an encrypted file or a WiFi network. Use longer passwords wherever you can.
Why not just pick 8 characters myself?
Short passwords chosen by people follow patterns and usually fall in minutes. Random selection is what makes eight characters usable at all.