A 15-character password sits at nearly 100 bits of entropy — a psychologically satisfying milestone that represents more combinations than there are atoms in a grain of sand. GitHub specifically recommends 15+ characters for all accounts. At this length, even the theoretical heat death of the universe arrives before your password could be brute-forced.
Entropy is calculated as: length × log₂(pool_size). With 15 characters from the full 95-char printable ASCII set, you get 99 bits of entropy. Brute-force time at 10 billion guesses/sec: 1.5 × 10¹² years.
50 pre-generated examples. Use the generator above for a cryptographically fresh password — these are for illustration only.
GitHub recommends 15+ characters and offers reduced 2FA requirements for longer passwords. Many security-focused platforms (1Password, Bitwarden) default to generating 15-16 character passwords. Enterprise Microsoft 365 with Conditional Access often sets 15 as the minimum for admin accounts.
Developer Accounts
GitHub, GitLab, Bitbucket, and npm accounts control source code and deployment pipelines. A compromised developer account can inject malicious code into production — SolarWinds-style supply chain attacks start with stolen credentials.
Admin & Root Accounts
System administrator accounts, cloud console access (AWS root, GCP admin), and database admin credentials. These accounts have unrestricted access and should use the strongest passwords possible.
Password Manager Vault
Your password manager master password protects all other passwords. 15+ characters is a common recommendation from 1Password, Bitwarden, and LastPass for the master password.
Professional Certifications
Accounts for professional platforms like LinkedIn, Upwork, and industry-specific portals where your professional reputation and identity are at stake.
Crack times assume 10 billion guesses/sec (GPU cluster with MD5). Bcrypt/Argon2 hashing makes these 10,000x–100,000x slower.
Is a 15-character password secure enough?
Yes. A 15-character password drawn from the full 95-character printable ASCII set provides 99 bits of entropy — well beyond what brute-force attacks can crack. It would take 1.5 × 10¹² years to break with current GPU technology. The generator above defaults to a 26-symbol set chosen to avoid characters that break web forms, which gives 96 bits; widen the symbols field to reach the full 95.
How long does it take to crack a 15-character password?
With a modern GPU cluster computing 10 billion hashes per second, a random 15-character password using all character types (95-char pool) would take approximately 1.5 × 10¹² years to crack by brute force. Using only lowercase letters would be significantly faster to crack.
Does character variety matter more than length?
Both matter, but length has a greater impact. Each additional character multiplies the total combinations by the pool size (up to 95 for all printable ASCII). However, using all character types (uppercase, lowercase, numbers, symbols) maximizes the pool size, which also multiplies security exponentially.
Should I use a password manager?
Yes. You cannot reliably memorize unique random passwords for every account. A password manager securely stores all your passwords behind one strong master password, and can auto-fill them across devices and browsers.
Which accounts need a 15-character password?
A 15-character password is recommended for: business accounts, admin portals, and developer tools. Always use the strongest password practical for each account, and never reuse passwords across sites.