Password security statistics 2026
This page publishes the data behind our generator: how length and word count translate into entropy, how long brute force actually takes against modern hardware, and what people search for across 11 languages. All numbers are reproducible from the formulas below; the query data comes from Google autocomplete collected on 31 October 2026.
Random password length vs entropy
| Length | Entropy (94-char pool) | Offline guesses at 10¹²/s | Recommended use |
|---|---|---|---|
| 8 characters | ~52 bits | ~1 hour | Low-value accounts only |
| 12 characters | ~79 bits | ~19,000 years | Minimum for email and work |
| 16 characters | ~105 bits | ~1.3 × 10¹² years | Default from a password manager |
| 20 characters | ~131 bits | ~8.6 × 10¹⁹ years | Master passwords, wallets, admin |
Passphrase word count vs entropy (EFF large wordlist, 7,776 words)
- 3 words — ~39 bits. Weak — avoid
- 4 words — ~52 bits. Comparable to an 8-character password
- 5 words — ~65 bits. Better than 10 random characters
- 6 words — ~78 bits. Comparable to 12 random characters
- 7 words — ~90 bits. Suitable for master passwords
What people search for (437 unique queries, 11 languages)
We collected Google autocomplete suggestions for generator, strength, manager, length and passphrase seeds in en, ua, ru, pl, de, es, fr, it, pt, ja and zh. Clusters by how many languages show demand:
- Generator (password generator, генератор паролів, …) — 11 / 11
- Strong/safe password guidance — 10 / 11
- Password managers and platforms — 9 / 11
- How to create a password — 9 / 11
- Exact password length (12/16/20 characters) — 5 / 11
- Passphrase / words / easy to remember — 4 / 11
Method
Entropy = log2(alphabet size) × length, with a 94-character alphabet (letters, digits, symbols). Passphrase entropy = log2(7776) × words ≈ 12.9 × words. Crack times assume 10¹² guesses per second, i.e. a modern multi-GPU offline attack against a fast hash — online attacks against a rate-limited login are orders of magnitude slower. All generation on this site uses the Web Crypto API in your browser; nothing is sent to a server.