Navigation menu toggle

Password security statistics 2026

This page publishes the data behind our generator: how length and word count translate into entropy, how long brute force actually takes against modern hardware, and what people search for across 11 languages. All numbers are reproducible from the formulas below; the query data comes from Google autocomplete collected on 31 October 2026.

Random password length vs entropy

LengthEntropy (94-char pool)Offline guesses at 10¹²/sRecommended use
8 characters~52 bits~1 hourLow-value accounts only
12 characters~79 bits~19,000 yearsMinimum for email and work
16 characters~105 bits~1.3 × 10¹² yearsDefault from a password manager
20 characters~131 bits~8.6 × 10¹⁹ yearsMaster passwords, wallets, admin

Passphrase word count vs entropy (EFF large wordlist, 7,776 words)

  • 3 words — ~39 bits. Weak — avoid
  • 4 words — ~52 bits. Comparable to an 8-character password
  • 5 words — ~65 bits. Better than 10 random characters
  • 6 words — ~78 bits. Comparable to 12 random characters
  • 7 words — ~90 bits. Suitable for master passwords

What people search for (437 unique queries, 11 languages)

We collected Google autocomplete suggestions for generator, strength, manager, length and passphrase seeds in en, ua, ru, pl, de, es, fr, it, pt, ja and zh. Clusters by how many languages show demand:

  • Generator (password generator, генератор паролів, …) — 11 / 11
  • Strong/safe password guidance — 10 / 11
  • Password managers and platforms — 9 / 11
  • How to create a password — 9 / 11
  • Exact password length (12/16/20 characters) — 5 / 11
  • Passphrase / words / easy to remember — 4 / 11

Method

Entropy = log2(alphabet size) × length, with a 94-character alphabet (letters, digits, symbols). Passphrase entropy = log2(7776) × words ≈ 12.9 × words. Crack times assume 10¹² guesses per second, i.e. a modern multi-GPU offline attack against a fast hash — online attacks against a rate-limited login are orders of magnitude slower. All generation on this site uses the Web Crypto API in your browser; nothing is sent to a server.

Sources

Generate a password with these settings →