Password examples · 16 characters
16 Character Password Examples
Fresh 16-character passwords for every character set, made in your browser - with how strong each kind is and which sites accept that length.
Never use a password you have seen in an article or screenshot. Published examples end up in attackers' wordlists. The examples below are generated for you when the page opens and are not shown to anyone else.
Lowercase letters
••••••••••••••••••••••••••••••••••••••••••••••••
Upper and lowercase letters
••••••••••••••••••••••••••••••••••••••••••••••••
Letters and numbers
••••••••••••••••••••••••••••••••••••••••••••••••
Letters, numbers and symbols
••••••••••••••••••••••••••••••••••••••••••••••••
Generated in your browser with crypto.getRandomValues(). Nothing is sent or stored. Verify it
How Strong Is a 16-Character Password?
Strength depends on which characters can appear, not only on the length. Each row below is a random 16-character password from this site's generator; times are averages (half of all possibilities) under the stated guessing speeds.
| Characters | Entropy | Online attack, rate-limited | Offline, slow hash (bcrypt) | Offline, fast hash, GPU rig | Offline, massive GPU cluster |
|---|---|---|---|---|---|
| Lowercase letters | 75.2 bits | 6.9 trillion years | 69 billion years | 6.9 thousand years | 691 years |
| Upper and lowercase letters | 91.2 bits | 453 quadrillion years | 4.5 quadrillion years | 453 million years | 45 million years |
| Letters and numbers | 95.2 bits | 10¹⁸ years | 71 quadrillion years | 7.1 billion years | 710 million years |
| Letters, numbers and symbols | 104.6 bits | 10²¹ years | 10¹⁹ years | 4.8 trillion years | 485 billion years |
Speeds: online attack, rate-limited 10²/s; offline, slow hash (bcrypt) 10⁴/s; offline, fast hash, gpu rig 10¹¹/s; offline, massive gpu cluster 10¹²/s. They are the same assumptions the entropy calculator uses, and they only apply to randomly generated passwords.
Which Sites Accept 16 Characters?
A 16-character password meets 10 of these 10 published length rules:
| Rule | 16 characters |
|---|---|
| NIST SP 800-63B: at least 15 when the password is the only factor | Meets it |
| NIST SP 800-63B: at least 8 when combined with a second factor | Meets it |
| Wi-Fi (WPA2): 8-63 characters | Meets it |
| Apple ID: requires at least 8 | Meets it |
| Microsoft account: requires at least 8 | Meets it |
| TikTok: recommends at least 12 | Meets it |
| Instagram: requires at least 6 | Meets it |
| Instagram: recommends at least 8 | Meets it |
| Gmail: recommends at least 12 | Meets it |
| Discord: requires at least 8 | Meets it |
16 Characters Compared
Every character added multiplies the number of possible passwords by the size of the character set - 94 when all types are allowed. Compare with 8-character examples and 12-character examples, or set any length from 8 to 64 in the password generator.
16-Character Password FAQs
Is a 16-character password strong enough?
A random 16-character password using all character types has 104.6 bits of entropy, rated "Very strong" on this site. With lowercase letters only it drops to 75.2 bits. NIST asks for at least 15 characters when a password is the only factor, which this length meets.
How long does it take to crack a 16-character password?
It depends on how it is stored and guessed. For a random password with all character types, an attacker making 10¹¹ guesses per second against a fast hash would need about 4.8 trillion years on average. Rate-limited online guessing is far slower. These are estimates for random passwords, not for passwords a person made up.
Can I use one of the example passwords?
The examples are created in your browser when the page loads, are not in the page source and are different for every visitor, so they are as random as the generator's output. Never use example passwords printed in articles or screenshots, though: those are public.
Do symbols matter in a 16-character password?
They add entropy per character: 95.2 bits with letters and numbers versus 104.6 bits with symbols added, at the same length. Adding a few characters adds about as much and is often easier.
Which sites accept a 16-character password?
It meets 10 of the 10 published length rules in the table above, including the services' own requirements and recommendations and NIST's baseline.
Should I memorise a password like this?
Usually not - let a password manager remember it. For the few passwords you must type from memory, a passphrase is easier at the same strength.
How are the entropy figures calculated?
From the number of passwords the generator can produce with those settings: every enabled character type is guaranteed to appear, which the calculation accounts for exactly. The entropy calculator shows the formula.
What about 8-character or 12-character passwords?
Related guides
Strong Password Examples
What Is a Passphrase?
