🔑 Password Length vs Complexity: What the Research Says in 2026
The UK National Cyber Security Centre banned mandatory complexity rules for government systems in 2021, citing evidence that those rules make passwords measurably weaker. Three years later, most corporate IT portals still demand a capital letter, a symbol, and a number. Password length versus complexity is not a close debate: length wins by a wide margin, and this guide shows exactly why.
A 20-character random lowercase password has approximately 94 bits of entropy. A 10-character password built from all 94 printable ASCII characters has roughly 65 bits. Adding character types adds far less than adding characters.
The entropy math: a direct comparison
Password strength in information theory is a function of two variables: how long a password is, and how many possible characters appear at each position. The formula log2(C^L) produces the entropy in bits. More bits means more computational work for an attacker running a brute-force or dictionary attack.
The table below shows entropy values for common password configurations. The "typical corporate policy" row reflects what most IT departments actually enforce in 2026: 8 characters with at least one uppercase, one digit, and one symbol.
| Password type | Length | Character set size | Entropy (bits) | Brute-force time at 10B guesses/sec |
|---|---|---|---|---|
| Typical corporate policy (8 chars, full ASCII) | 8 | 94 | 52.4 bits | ~7 minutes |
| Common "strong" password (12 chars, full ASCII) | 12 | 94 | 78.6 bits | ~9.5 years |
| Long lowercase only (20 chars, a-z) | 20 | 26 | 94.0 bits | ~631,000 years |
| Random generator, 16 chars (full ASCII) | 16 | 94 | 104.9 bits | ~2 billion years |
| Random generator, 20 chars (full ASCII) | 20 | 94 | 131.0 bits | Effectively infinite |
The 8-character policy falls at 52 bits. A modern GPU cluster cracking bcrypt-hashed passwords achieves approximately 1 billion hashes per second. At that rate, 52-bit entropy falls in roughly seven minutes. No policy requiring "must include a symbol" makes that meaningfully harder; the attacker's rulesets already model every predictable substitution.
Why complexity rules backfire
The problem with mandatory complexity is predictability. When told to add a symbol to password, most people produce P@ssw0rd!. Attackers know this. Password cracking tools like Hashcat ship with mangling rulesets that automatically try every common substitution: a becomes @, e becomes 3, i becomes 1 or !, o becomes 0, and a capital goes at the start with punctuation at the end.
The Hashcat "best64" ruleset applies 64 transformations to every base word in a dictionary. A 10-million-word wordlist becomes 640 million candidates in seconds. "P@ssw0rd!" appears on page one of that list.
A Carnegie Mellon University study published in 2016 analyzed 100,000 passwords created under five different complexity policies. Users who faced stricter rules chose passwords with significantly lower guessing resistance per character of length than users who faced simple minimum-length requirements. The complexity overhead was absorbed by predictable patterns rather than genuine randomness.
What NIST SP 800-63B actually says
NIST Special Publication 800-63B is the United States government's authoritative standard on digital authentication. Originally released in 2017 and updated in September 2024, it reversed two decades of conventional password policy wisdom.
"Verifiers and CSPs SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types or prohibiting consecutively repeated characters) for passwords chosen by the subscriber." NIST SP 800-63B, Section 3.1.1, September 2024
The same document sets a minimum length of 8 characters for user-chosen passwords but notes that "longer passwords generally provide more security." NIST recommends allowing passwords up to at least 64 characters and checking new passwords against lists of known-compromised credentials rather than enforcing character composition requirements.
NIST also eliminated the recommendation for periodic password changes unless there is evidence of compromise. The original rationale for forced changes was that passwords would be stolen and used; the practical outcome was that users incremented predictable suffixes (March2026!, April2026!, May2026!), which attackers model trivially.
The NCSC's three random words approach
The UK National Cyber Security Centre offers a practical alternative to complex passwords for accounts that require a memorable credential: three random words. "correcthorsebattery", "purplecafequartz", "bricklaundryolive" each provide 15-20 characters of length without requiring a user to remember substitution patterns.
"A long password does not need to be complex. Three random words can create a password that is both long and memorable, and harder for attackers to guess than a shorter 'complex' alternative." UK National Cyber Security Centre, Password Administration for System Owners, 2023
Three words drawn randomly from a 7,776-word Diceware list add approximately 12.9 bits per word (log2 of 7,776). Three words provide about 38.8 bits. Four words reach 51.8 bits. That is comparable to the corporate 8-character policy but with far less user friction: no substitution rules to remember, no "password doesn't meet requirements" errors. The NCSC approach works specifically because the words are chosen randomly, not by the user's preference.
Minimum password lengths for 2026
Different account types carry different risk profiles. The right minimum length varies accordingly.
| Account type | Minimum recommended length | Why |
|---|---|---|
| Password manager master password | 20 characters or 5+ random words | Single point of failure; no 2FA fallback in most scenarios |
| Email account | 16 characters | Controls account recovery for every other service |
| Banking and financial accounts | 16 characters | Direct financial exposure; often limits to 20-character maximum |
| Work accounts (SSO, VPN, email) | 15 characters | NIST 800-63B strong recommendation; breach affects colleagues |
| Social media, forums, low-risk sites | 12 characters (random) | Lower stakes; password manager handles storage |
| Sites with 8-character maximum | 8 characters (full character set, random) | Work within the constraint; avoid predictable patterns |
Sites that cap passwords at 8 or 10 characters present a genuine security risk. A capped 8-character limit often indicates passwords are stored in plain text or an inadequate hash, since there is no technical reason to cap length for properly hashed credentials. If a site cannot accept a 20-character password, treat it as a higher-risk service and enable multi-factor authentication if available.
Where random generators solve the problem
The core issue with human-chosen passwords is that humans are not random. People pick words they know, patterns they find memorable, and substitutions they consider "clever." An attacker with access to a person's social media profile can generate a targeted wordlist that cracks personal passwords far faster than a brute-force attack.
A cryptographically secure random password generator removes the human bias entirely. Every character is drawn independently from a uniform distribution over the chosen set. There is no pattern, no substitution, no dictionary entry. The entropy calculation above holds in full: 20 characters from 94 printable ASCII characters reliably produces 131 bits of entropy with no dependence on the user's preferences or habits.
The practical constraint is memorability. A 20-character random string like xK7!mNqP2vRtJwL9dYcE is not memorizable. This is not a problem for password manager users: the generator creates the password, the manager stores it, and the user never types it manually. The only credential worth memorizing in 2026 is the manager's master password, which works better as a long passphrase anyway.
A password manager like NordPass includes a built-in generator set to 20 characters with full character set enabled by default. Users who set generated passwords for every account and store them in an encrypted vault effectively eliminate the length-versus-complexity question: every password is both long and random, which is the only configuration that wins on both dimensions simultaneously.
How to audit your current passwords
Most password managers include a security audit feature. Run it and look for three categories:
- Short passwords (under 12 characters). Prioritize replacing these first, starting with email and financial accounts.
- Reused passwords. One breach exposes every account sharing the same credential.
- Passwords matching known breach lists. Have I Been Pwned's API checks whether a specific password hash appears in any known breach database, without transmitting the password itself.
For workplace IT policies, the evidence now points clearly toward raising the minimum length to 15 characters while removing the complexity composition rule entirely. Check against a breached-password list at enrollment and on any failed login sequence. Do not force periodic changes unless the credential appears in a new breach. This is the NIST-aligned approach and it reduces help-desk password-reset load substantially, since users no longer cycle through variations of the same predictable base word.
Frequently asked questions
Does password length or complexity matter more?
Length matters more than complexity at every comparable character count. A 20-character lowercase-only password provides approximately 94 bits of entropy. A 10-character password using all 94 printable ASCII characters provides approximately 65 bits. The entropy gain from adding more characters far exceeds the gain from adding more character types. NIST SP 800-63B explicitly removed mandatory complexity requirements and recommends a minimum length of 15 characters for memorized passwords.
What does NIST say about password complexity rules?
NIST SP 800-63B, last revised in September 2024, states that verifiers "SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types)." Mandatory complexity rules produce predictable substitutions that attackers model directly in their Hashcat rulesets. NIST recommends checking passwords against breached credential lists and enforcing minimum length rather than character type requirements.
How long should a password be in 2026?
For accounts stored in a password manager, 20 or more random characters from the full character set provides approximately 131 bits of entropy. For passwords typed by hand, three to five random words (a Diceware passphrase) reaches 39-65 bits and is genuinely memorable. NIST's hard minimum is 8 characters, but 15 or more is the practical recommendation for any account with real stakes.