A 12-character password is the modern baseline recommendation from CISA, the EFF, and most cybersecurity professionals. With 79 bits of entropy, it would take over a million years to brute-force even with the most powerful GPU clusters available today. This is the minimum length where you can be confident your password won't be cracked by brute force in your lifetime.
Entropy is calculated as: length × log₂(pool_size). With 12 characters from the full 95-char printable ASCII set, you get 79 bits of entropy. Brute-force time at 10 billion guesses/sec: 1.7M years.
50 pre-generated examples. Use the generator above for a cryptographically fresh password — these are for illustration only.
Microsoft 365 enterprise policies often default to 12-character minimums. AWS IAM recommends 14+ but commonly sets 12 as the floor. GitHub recommends 15+ for developer accounts. Most modern password policies (NIST 800-63B) suggest 12 as a reasonable minimum when combined with other controls.
Email Accounts
Your email is the master key to everything — password resets, 2FA recovery codes, and identity verification all flow through email. Use at least 12 characters for Gmail, Outlook, and ProtonMail.
Cloud Storage
Google Drive, Dropbox, iCloud, and OneDrive contain documents, photos, and sensitive files. A 12-character password protects years of personal and professional data.
Work Accounts
Slack, Jira, Confluence, Notion, and other workplace tools often contain proprietary information. 12 characters is the minimum for professional use.
Financial Accounts
Banking and investment accounts should use 12+ characters minimum. Pair with 2FA (preferably hardware keys) for maximum protection against targeted attacks.
Crack times assume 10 billion guesses/sec (GPU cluster with MD5). Bcrypt/Argon2 hashing makes these 10,000x–100,000x slower.
Is a 12-character password secure enough?
Yes. A 12-character password drawn from the full 95-character printable ASCII set provides 79 bits of entropy — well beyond what brute-force attacks can crack. It would take 1.7M years to break with current GPU technology. The generator above defaults to a 26-symbol set chosen to avoid characters that break web forms, which gives 77 bits; widen the symbols field to reach the full 95.
How long does it take to crack a 12-character password?
With a modern GPU cluster computing 10 billion hashes per second, a random 12-character password using all character types (95-char pool) would take approximately 1.7M years to crack by brute force. Using only lowercase letters would be significantly faster to crack.
Does character variety matter more than length?
Both matter, but length has a greater impact. Each additional character multiplies the total combinations by the pool size (up to 95 for all printable ASCII). However, using all character types (uppercase, lowercase, numbers, symbols) maximizes the pool size, which also multiplies security exponentially.
Should I use a password manager?
Yes. You cannot reliably memorize unique random passwords for every account. A password manager securely stores all your passwords behind one strong master password, and can auto-fill them across devices and browsers.
Which accounts need a 12-character password?
A 12-character password is recommended for: general accounts, email, and social media. Always use the strongest password practical for each account, and never reuse passwords across sites.