A random 16-character password is an excellent default for accounts stored in a password manager. With all 94 printable characters it has about 105 bits of entropy. Use the generator above — it opens at 16 characters, and you can still adjust the length if a site needs something different.
Why 16 characters is the sweet spot
Sixteen characters is long enough to be practically uncrackable — about 105 bits of entropy with all character types — while still fitting the many sites that cap passwords at 16. It is the default length in several popular password managers and browsers, and a great general recommendation if you don’t want to think about it.
- Exceeds the 15-character NIST minimum for single-factor accounts.
- Fits 16-character limits on older banking and telecom sites.
- Short enough to type from a phone screen if you ever have to.
16 characters without symbols
If a site refuses symbols, a 16-character letters-and-numbers password still gives about 95 bits, which remains extremely strong. For even more compatibility, use the alphanumeric generator.
16-digit vs. 16-character
A 16-digit code (numbers only) has just 53 bits — fine as a PIN-style code with attempt limits, but much weaker than 16 mixed characters. Use the PIN generator for numeric codes.
How strong is a 16-character password?
The table shows how many different 16-character passwords exist for each character set, and how long an offline attacker testing 100 billion guesses per second (a multi-GPU rig against a fast hash such as MD5 or NTLM) would need on average to find a randomly generated one.
| Character set | Possible passwords | Entropy | Average time to crack |
|---|---|---|---|
| Numbers only (0–9) | 1.0 × 1016 | 53 bits | about 14 hours |
| Lowercase letters | 4.4 × 1022 | 75 bits | about 6,909 years |
| Letters (A–Z, a–z) | 2.9 × 1027 | 91 bits | about 453 million years |
| Letters + numbers | 4.8 × 1028 | 95 bits | about 7.6 billion years |
| All printable characters | 3.7 × 1031 | 105 bits | about 427× the age of the universe |
These figures assume the password is truly random. A 16-character password built from a word, a name or a date can be cracked in a tiny fraction of this time. Check any password with the strength checker.
Other password lengths
- 8 characters
- 10 characters
- 12 characters
- 14 characters
- 15 characters
- 16 characters
- 20 characters
- 24 characters
- 32 characters
- 64 characters
Last updated: · Reviewed by the Password Generator team