Beyond brute force
At 16 random characters, guessing stops being a realistic attack. Attackers turn to phishing, malware and reused passwords instead, so the next step is two-factor authentication, not an even longer password.
16-character password generator
Sixteen characters. The sweet spot.
With all four character types, a GPU cluster would need about 12 times the age of the universe to crack it, and it still fits almost every password field. Sixteen random characters is the length we recommend for everyday accounts.
Calculating…
PINs are only safe where attempts are limited, like a phone or a bank card. Obvious ones (1234, 0000, 1212) are skipped.
10 fresh passwords
Time to crack your 16-character password
Measuring…
Worst case: an offline attack on a fast hash by a GPU cluster testing one trillion guesses per second.
You are here
- 1 second
- 1 hour
- 1 year
- A lifetime
- The pyramids
- Since the dinosaurs
- Age of the universe
The numbers
How long does 16 characters really last?
Each extra random character multiplies the work. Here are 16 random characters against the two offline attacks that matter: a GPU cluster on a fast hash (1 trillion guesses per second) and a GPU rig on bcrypt (100,000 guesses per second).
| 16 random characters | Entropy | GPU cluster, fast hash | GPU rig, bcrypt |
|---|---|---|---|
| Numbers only 0-9 | 53 bits | 1 hour | 1.6 thousand years |
| Lowercase a-z | 75 bits | 691 years | 6.9 billion years |
| Upper and lower a-z A-Z | 91 bits | 45 million years | 453 trillion years |
| Letters and numbers a-z A-Z 0-9 | 95 bits | 755 million years | 7.6 quadrillion years |
| Letters, numbers and symbols + !@#$% | 103 bits | 171 billion years | 1.7 × 1018 years |
Even without symbols, 16 random letters and numbers hold for about 755 million years against the fastest attack. That makes 16 a safe default when a site rejects some symbols.
Why 16
Strong everywhere, accepted everywhere.
Fits where 20 does not
Some sites still cap passwords at 16 characters. Sixteen random characters fill those fields completely, and the same length works everywhere else.
Clears every common rule
NIST asks for 15 characters when a password is the only factor, PCI DSS for 12, and the CNIL recommends 12 with all four character types. Sixteen random characters meet all of them. Build your own rules with the policy builder.
Made for a password manager
Nobody memorizes 16 random characters, and that is fine: your password manager stores and fills them. For the manager's own master password, pick a passphrase.
Questions
16-character password FAQ
Is a 16-character password strong enough?
Yes. With all four character types it carries about 103 bits of entropy: a GPU cluster attacking a fast hash would need around 171 billion years, about 12 times the age of the universe. Without symbols it still holds for hundreds of millions of years.
16 random characters or a passphrase?
Random characters pack more strength per character, passphrases are easier to type. Use 16 random characters for everything your password manager fills in, and a passphrase of 6 or 7 random words for the few passwords you type yourself.
Can a 16-character password be hacked?
Not by guessing, but it can be stolen: by a phishing page, by malware, or in the breach of a site where you reused it. Keep it unique to one account and turn on two-factor authentication or passkeys wherever you can.
Why do some sites limit passwords to 16 characters?
Usually for legacy reasons: old databases with fixed-size columns or rules written years ago. A short cap may also suggest that passwords are not hashed properly, so use the full 16 random characters there, keep them unique, and turn on 2FA.
Does the generator use all four character types?
Yes. By default every password gets at least one uppercase letter, one lowercase letter, one digit and one symbol; the rest is drawn from the full set and shuffled. Switch a type off if a site rejects some symbols.
More free tools
Passphrase generator
Random words you can actually remember, with the entropy of a 16-character password.
Open toolWi-Fi password + QR code
A strong WPA2/WPA3 key and a QR code your guests scan to join, with a card to print.
Open toolStrength test
See your password the way an attacker does: patterns, entropy and four crack-time scenarios.
Open toolBreach checker
Find out if a password already leaked, without ever revealing it (k-anonymity).
Open toolPassword policy builder
NIST, PCI DSS and CIS presets with ready-to-run Windows, Active Directory and Linux scripts.
Open toolCrack-time table
How long every length and character mix survives a modern GPU cracking rig.
Open tool