Password Length Beats Complexity Rules
Entropy for 10, 14 and 18 characters with one to four character sets, and what forms should require.
By the TurantTools Dev team · Updated October 27, 2026 · 3 min read
"Must contain a capital, a number and a symbol" feels secure, but each extra character set adds less than one extra character of length does. NIST's guidance now favours length over composition rules.
| Character sets | 10 characters | 14 characters | 18 characters |
|---|---|---|---|
| Lowercase only | 47 bits | 66 bits | 85 bits |
| Letters | 57 bits | 80 bits | 103 bits |
| Letters + digits | 60 bits | 83 bits | 107 bits |
| All four sets | 64 bits | 90 bits | 116 bits |
An 18-character lowercase password beats a 10-character one with every set.
For your sign-up form
- Require a minimum length (at least 8, better 12 or more) and allow long passwords, up to 64 characters or more.
- Check new passwords against lists of breached passwords instead of forcing symbols.
- Allow paste so password managers work, and don't force regular changes without a reason.