Password examples · 8 characters
8 Character Password Examples
Fresh 8-character passwords for every character set, made in your browser - with how strong each kind is and which sites accept that length.
Never use a password you have seen in an article or screenshot. Published examples end up in attackers' wordlists. The examples below are generated for you when the page opens and are not shown to anyone else.
Lowercase letters
••••••••••••••••••••••••
Upper and lowercase letters
••••••••••••••••••••••••
Letters and numbers
••••••••••••••••••••••••
Letters, numbers and symbols
••••••••••••••••••••••••
Generated in your browser with crypto.getRandomValues(). Nothing is sent or stored. Verify it
How Strong Is a 8-Character Password?
Strength depends on which characters can appear, not only on the length. Each row below is a random 8-character password from this site's generator; times are averages (half of all possibilities) under the stated guessing speeds.
| Characters | Entropy | Online attack, rate-limited | Offline, slow hash (bcrypt) | Offline, fast hash, GPU rig | Offline, massive GPU cluster |
|---|---|---|---|---|---|
| Lowercase letters | 37.6 bits | 33 years | 121 days | 1 second | less than a second |
| Upper and lowercase letters | 45.6 bits | 8.4 thousand years | 84 years | 4.4 minutes | 27 seconds |
| Letters and numbers | 47.2 bits | 25 thousand years | 253 years | 13 minutes | 1.3 minutes |
| Letters, numbers and symbols | 51.3 bits | 445 thousand years | 4.4 thousand years | 3.9 hours | 23 minutes |
Speeds: online attack, rate-limited 10²/s; offline, slow hash (bcrypt) 10⁴/s; offline, fast hash, gpu rig 10¹¹/s; offline, massive gpu cluster 10¹²/s. They are the same assumptions the entropy calculator uses, and they only apply to randomly generated passwords.
Which Sites Accept 8 Characters?
A 8-character password meets 7 of these 10 published length rules:
| Rule | 8 characters |
|---|---|
| NIST SP 800-63B: at least 15 when the password is the only factor | Too short |
| NIST SP 800-63B: at least 8 when combined with a second factor | Meets it |
| Wi-Fi (WPA2): 8-63 characters | Meets it |
| Apple ID: requires at least 8 | Meets it |
| Microsoft account: requires at least 8 | Meets it |
| TikTok: recommends at least 12 | Too short |
| Instagram: requires at least 6 | Meets it |
| Instagram: recommends at least 8 | Meets it |
| Gmail: recommends at least 12 | Too short |
| Discord: requires at least 8 | Meets it |
8 Characters Compared
Every character added multiplies the number of possible passwords by the size of the character set - 94 when all types are allowed. Compare with 12-character examples and 16-character examples, or set any length from 8 to 64 in the password generator.
8-Character Password FAQs
Is a 8-character password strong enough?
A random 8-character password using all character types has 51.3 bits of entropy, rated "Fair" on this site. With lowercase letters only it drops to 37.6 bits. NIST asks for at least 15 characters when a password is the only factor, which this length does not meet.
How long does it take to crack a 8-character password?
It depends on how it is stored and guessed. For a random password with all character types, an attacker making 10¹¹ guesses per second against a fast hash would need about 3.9 hours on average. Rate-limited online guessing is far slower. These are estimates for random passwords, not for passwords a person made up.
Can I use one of the example passwords?
The examples are created in your browser when the page loads, are not in the page source and are different for every visitor, so they are as random as the generator's output. Never use example passwords printed in articles or screenshots, though: those are public.
Do symbols matter in a 8-character password?
They add entropy per character: 47.2 bits with letters and numbers versus 51.3 bits with symbols added, at the same length. Adding a few characters adds about as much and is often easier.
Which sites accept a 8-character password?
It meets 7 of the 10 published length rules in the table above, including the services' own requirements and recommendations and NIST's baseline.
Should I memorise a password like this?
Usually not - let a password manager remember it. For the few passwords you must type from memory, a passphrase is easier at the same strength.
How are the entropy figures calculated?
From the number of passwords the generator can produce with those settings: every enabled character type is guaranteed to appear, which the calculation accounts for exactly. The entropy calculator shows the formula.
What about 12-character or 16-character passwords?
Related guides
Strong Password Examples
What Is a Passphrase?
