Why does CISA recommend 16 character passwords?

CISA recommends 16 characters because shorter random passwords fall faster as guessing hardware improves. A random 16-character password with letters, numbers, and symbols has about 105 bits of entropy. On a fast hash at about 1 trillion guesses per second, brute-force takes more than a trillion years, per the crack-time table on this site.

Is 16 characters enough for a password?

A random 16-character password using letters, numbers, and symbols is strong enough for most accounts. It matches CISA's length recommendation and has about 105 bits of entropy. A 16-character password of letters and digits only still takes about 1.5 billion years to brute-force on a fast hash. Invented or reused passwords do not get these times.

What's the difference between 15 and 16 character passwords?

On a mixed set of letters, numbers, and symbols, one extra character makes brute-force about 95 times harder. A random 15-character password takes about 15 billion years on a fast hash. A random 16-character password takes more than a trillion years. Use 16 when the site allows it.

When should I use more than 16 characters?

Use 20+ characters for maximum security accounts like cryptocurrency wallets, server root access, or password manager master passwords. For regular accounts, 16 characters provides more than adequate protection.

Generate a 16 Character Password

Q: Can I make a 16-digit or 16-letter password?

Yes. Open Customize and turn character sets on or off. Letters and digits only is a common site rule. Letters only is weaker than mixed. Prefer letters, numbers, and symbols when the site allows them. The generator still uses crypto.getRandomValues() either way.

A random 16-character password with letters, numbers, and symbols takes more than a trillion years to brute-force on a fast hash (about 1 trillion guesses per second), according to our crack-time table.

🔒 Client-Side Generated. View Source on GitHub →

Click password to copy

Customize

Length: 16

123264

Time to crack:

See how 16 characters stacks up across every character set

Character Sets

ABC Uppercase abc Lowercase 123 Numbers !@# Symbols

Avoid ambiguous characters (O, 0, l, I, 1)

Want a memorable passphrase instead? →

Need a different length? Try our 15 character generator.

Why 16 Characters Is the New Standard

In 2024, CISA (Cybersecurity and Infrastructure Security Agency) updated their guidance: 16 characters minimum for all passwords. Eight or twelve is no longer the bar. Sixteen is.

Why the change? Attackers got faster. A lot faster.

The Math: Why 16 Beats 12

Length	Entropy	Time to Crack
8 characters	52 bits	Minutes to hours
12 characters	78 bits	17k years
15 characters	98 bits	15 billion years
16 characters	105 bits	More than a trillion years

Those times are brute-force ceilings for a random password using letters, numbers, and symbols on a fast hash, matching the crack-time table. One extra character multiplies the search space by about 95. A 16-character password of letters and digits only (no symbols) still takes about 1.5 billion years.

When to Use 16 Characters

Primary email account. The master key to all your resets
Password manager master password. Protects everything else
Banking and financial accounts. Where the money is
Work accounts. Especially with admin access
Any account without MFA. Password is your only defense

When 16 Isn't Enough

For maximum security accounts (crypto wallets, root server access), consider 20+ characters or a passphrase. But for 99% of accounts, 16 random characters is overkill in the best way.

What About Sites That Cap at 12?

Some legacy systems won't accept 16 characters. In that case:

• Use the maximum they allow
• Enable MFA (required, not optional)
• Consider whether you trust that service with sensitive data

Bottom line: 16 characters is the sweet spot. Long enough to be uncrackable, short enough that most systems accept it.

Read our password length research | How entropy works | Need 15 characters instead?

SPG

"Why we built this: Most password tools are bloated or send your data to a server. You shouldn't need a CS degree just to stay safe.

SafePasswordGenerator is built on a simple promise: no database, and no extra software. Just browser-based math keeping you secure."

, The SPG Privacy Project Read the full story →

🧬

Cryptographically Secure

Uses Web Crypto API's crypto.getRandomValues() for true randomness. No pseudo-random number generators.

🛡️

Client-Side Only

All password generation happens in your browser. No data is sent to our servers or stored anywhere.

🌐

Open Source

Transparent codebase you can audit anytime. Browse the GitHub repo →

What are you securing today?

📶

WiFi / Router

Generate WPA2 keys

🧠

Memorable

Generate passphrases

🔢

PIN Code

Generate secure PINs

Frequently asked questions

Is a 16 character password strong enough?

A random 16-character password with letters, numbers, and symbols takes more than a trillion years to brute-force on a fast hash. A 16-letter-and-digit password (no symbols) takes about 1.5 billion years. Use 16 when the site allows it. Invented passwords do not get these times.

Can I make a 16-digit or 16-letter password?

Yes. Open Customize. Turn symbols off for letters and digits. Turn numbers off for letters only. Some older sites ban symbols. Prefer all four types when the site allows them. Generation still uses crypto.getRandomValues() in your browser.

What is the difference between 15 and 16 characters?

One extra random character multiplies the search space by about 95 on a mixed set. Use 15 only when a site will not take 16.

🔏

Your Privacy is Protected

We don't collect, store, or transmit your passwords. Your passwords are generated locally in your browser using industry-standard cryptographic functions.