A random 8-character password is the bare minimum — acceptable only with two-factor authentication. With all 94 printable characters it has about 52 bits of entropy. Use the generator above — it opens at 8 characters, and you can still adjust the length if a site needs something different.
When an 8-character password makes sense
Eight characters is the minimum most websites accept, and NIST SP 800-63B Rev. 4 allows it only when the password is combined with multi-factor authentication. You will meet the 8-character limit on older banking portals, some point-of-sale systems, legacy mainframes, Wi-Fi keys (the WPA2 minimum), and devices like printers or IP cameras that cap password fields.
If the system lets you choose, go longer. If it forces 8, make every character count: use all four character types and let the generator choose them randomly. Summer24 and k#9Rv!2q are both eight characters — the first is cracked in seconds with a dictionary, the second needs a brute-force search of 6 quadrillion combinations.
Protecting an account stuck at 8 characters
- Turn on two-factor authentication — it makes the short password far less critical.
- Never reuse this password anywhere else.
- Use the full 94-character set; an 8-digit numeric code has only 100 million combinations.
How strong is a 8-character password?
The table shows how many different 8-character passwords exist for each character set, and how long an offline attacker testing 100 billion guesses per second (a multi-GPU rig against a fast hash such as MD5 or NTLM) would need on average to find a randomly generated one.
| Character set | Possible passwords | Entropy | Average time to crack |
|---|---|---|---|
| Numbers only (0–9) | 1.0 × 108 | 27 bits | instantly |
| Lowercase letters | 2.1 × 1011 | 38 bits | about 1 seconds |
| Letters (A–Z, a–z) | 5.3 × 1013 | 46 bits | about 4 minutes |
| Letters + numbers | 2.2 × 1014 | 48 bits | about 18 minutes |
| All printable characters | 6.1 × 1015 | 52 bits | about 8 hours |
These figures assume the password is truly random. A 8-character password built from a word, a name or a date can be cracked in a tiny fraction of this time. Check any password with the strength checker.
Other password lengths
- 8 characters
- 10 characters
- 12 characters
- 14 characters
- 15 characters
- 16 characters
- 20 characters
- 24 characters
- 32 characters
- 64 characters
Last updated: · Reviewed by the Password Generator team