A random 15-character password is the NIST minimum for passwords used without multi-factor authentication. With all 94 printable characters it has about 98 bits of entropy. Use the generator above — it opens at 15 characters, and you can still adjust the length if a site needs something different.
15 characters: the new NIST baseline
In 2025 the U.S. National Institute of Standards and Technology finalised SP 800-63B Revision 4. For passwords used as a single factor, services shall require a minimum of 15 characters; with multi-factor authentication the minimum is 8. Many organisations are updating their policies to match, so 15 is quickly becoming the number to aim for.
The same guidance tells services to stop forcing composition rules and periodic changes, to allow at least 64 characters, and to block passwords found in breach lists. In other words: length and uniqueness over complexity.
How strong is 15 characters?
A random 15-character password with the full 94-character set provides about 98 bits of entropy. Even with letters and numbers only it reaches 89 bits — well beyond any brute-force attack today. Windows administrators will also recognise 15 as the length at which Windows stops storing the legacy LM hash.
How strong is a 15-character password?
The table shows how many different 15-character passwords exist for each character set, and how long an offline attacker testing 100 billion guesses per second (a multi-GPU rig against a fast hash such as MD5 or NTLM) would need on average to find a randomly generated one.
| Character set | Possible passwords | Entropy | Average time to crack |
|---|---|---|---|
| Numbers only (0–9) | 1.0 × 1015 | 50 bits | about 1 hour |
| Lowercase letters | 1.7 × 1021 | 71 bits | about 266 years |
| Letters (A–Z, a–z) | 5.5 × 1025 | 86 bits | about 8.7 million years |
| Letters + numbers | 7.7 × 1026 | 89 bits | about 122 million years |
| All printable characters | 4.0 × 1029 | 98 bits | about 5× the age of the universe |
These figures assume the password is truly random. A 15-character password built from a word, a name or a date can be cracked in a tiny fraction of this time. Check any password with the strength checker.
Other password lengths
- 8 characters
- 10 characters
- 12 characters
- 14 characters
- 15 characters
- 16 characters
- 20 characters
- 24 characters
- 32 characters
- 64 characters
Last updated: · Reviewed by the Password Generator team