How many characters should a password be?

Question

I use the lastpass password manager. Lastpass can create a password from 10-100 characters. I would like to know what is the recommended value. I had a look a look at some questions like this and I didn't find any good answers.

This is not a question about which password manager is best

score 3 · Accepted Answer · answered Dec 24 '15 at 15:59

3

As long and as complex as allowed

You're using a password manager, so opt for the best you can do based on the limitations imposed by the website. If it will take you just as long to generate an 8 character password as a 100 character password that meets the requirements, it would be silly to go with less entropy for the sake of meeting some artificial limit you put on yourself.

answered Dec 24 '15 at 15:59

This has answered my question. I that case I will go and change all my passwords to 100-character ones. Sigh. :/ – StairCeption Dec 24 '15 at 16:12
@StairCeption If you're feeling extra ambitious or potentially paranoid, there's KeyPass, which has no upper-limit on length that I'm aware of. I know it's much higher than 100, however. – Dec 24 '15 at 16:15
1

I don't feel the need for a +100 character password. Thanks for the suggestion though. – StairCeption Dec 24 '15 at 20:00

score 1 · Answer 2 · edited Dec 29 '15 at 18:04

I'm sure you will get better answers than this one that detail the exact maths.

A password can be as long as you want it to be (within the rules of the system). The longer it is, the more it will slow down someone who is trying to bruteforce it. Making it more complex by adding special characters, numbers upper and lower case letters will slow them down even more.

Bruteforcing passwords costs money, so really you just want to make it so it is not worth the cost of bruteforcing your password. That worth will be determined by what you are using it for.

You can check the strength of any possible passwords you may want to use at www.passwordmeter.com

As a rule of thumb, I would suggest at least 7 to 9 characters with some special characters, numbers and upper and lower case characters. This is just my opinion though and not hard and fast rules.

One mistake I often see is passwords that are so complex either because the password policy forces it or because the user just wants it, that people can't remember their passwords, so they end up making an insecure copy of it, i.e writing it down on sticky note. Writing it down undermines the whole purpose of have having a really complex password in the first place.

So password length and complexity is also a compromise between accessibly, ease of use and security.

The OP says they are using a password manager. Does this not mean that they can maximize the length and complexity without sacrificing accessibility and ease-of-use? — schroeder, Dec 29 '15 at 18:05

How many characters should a password be?

2 Answers2