Ten characters chosen at random among 76 hold about 62.5 bits, or 61.8 bits with one of each type required. Compared with 8 characters, that multiplies the guessing work by 76 × 76 = 5,776. For an attacker doing 10¹² fast-hash guesses each second, covering half the space stretches from about 4 minutes to about 23 days.
Two characters, five thousand times the work
Each character you add multiplies the number of possible passwords by the size of the character set. With all four types on, that is 76 per character, so going from 8 to 10 characters makes an exhaustive search 5,776 times longer. Swapping in a richer character set does far less: moving an 8-character password from letters and digits to all four types multiplies the work by about 5, not thousands.
That is the whole case for length in one comparison. Ten characters of nothing but lowercase letters and digits give 51.7 bits. Eight characters drawing on every type give 50.0 bits. The longer, plainer password wins, and it is easier to type on a phone.
Make a 10-character password
- Keep the length at 10 and leave every character type enabled.
- If the system you are signing up to rejects symbols or lowercase, turn those types off before generating.
- Press Generate and check that the entropy reads about 62 bits, or less if you removed types.
- Paste the password into the form, then save it in your password manager.
- Sign out and sign back in once, to confirm the system stored all 10 characters.
Guessing times at this length
The figures below are the average time to find the password by trying every possibility, assuming the attacker has its hash and knows how it was generated. They depend entirely on the guess rate, so here are the assumptions:
- Fast hash, one GPU: 10¹⁰ guesses per second. That is a little under half of what a single RTX 4090 achieved against SHA-256 in a published hashcat benchmark.
- Fast hash, several GPUs: 10¹² guesses per second. Four RTX 4090 cards attacking NTLM, the hash Windows uses for local and domain accounts, slightly exceed this.
| Character set (size) | Bits at 10 | 10¹⁰ per second | 10¹² per second | Work compared with 8 characters |
|---|---|---|---|---|
| Uppercase and digits (36) | 51.7 | 2 days | 30 minutes | × 1,296 |
| Letters and digits (62) | 59.5 | 486 days | 5 days | × 3,844 |
| All four, look-alikes out (70) | 61.3 | 4 years | 16 days | × 4,900 |
| All four, one of each (76) | 61.8 | 6 years | 23 days | × 7,567 |
| All four, any mix (76) | 62.5 | 10 years | 37 days | × 5,776 |
The "one of each" row grows faster than 5,776 because the mixing rule removes a smaller share of combinations at 10 characters (37.8%) than at 8 (52.5%). With a slow, salted hash such as bcrypt at cost 10, roughly 10⁴ guesses per second per card, every row here moves into millions of years. What decides your safety is how the service stores the password, which is one more reason to vary passwords across services.
Systems that stop at 10
A few systems still cap passwords at exactly this length. IBM i, the server operating system that grew out of the AS/400, has a password level setting. At levels 0 and 1, user profile passwords can be 1 to 10 characters long and may contain only the letters A–Z, the digits 0–9 and the characters $, @, # and underscore. Levels 2 and 3 allow up to 128 characters of any kind.
To fit a level 0 or 1 system, set this generator to 10 characters with only uppercase and digits on. That gives 36 possible characters, 51.7 bits, and nothing the system will refuse. The generator's symbol set includes characters such as ! and % that those levels reject, so leave symbols off even though $, @, # and _ would be accepted.
The same approach works for any device with a short cap: match the allowed characters exactly, then use every position available.
Where 10 characters fit
- Accounts that also use a second factor, where 10 random characters comfortably exceed the 8-character minimum NIST sets for multi-factor use.
- Systems with a hard 10-character limit, filled to the maximum.
- Temporary passwords that the user must change at first sign-in, provided they are delivered privately.
Where 10 characters fall short
- Single-factor accounts. Under NIST's 2025 rules, a password with nothing else behind it needs 15 characters or more.
- Payment systems. PCI DSS 4.0 has required 12 characters since 31 March 2025; use the 12-character preset.
- Anything attacked offline at fast-hash speeds. Twenty-three days for a modest GPU rig is not a margin worth relying on for an encrypted file or a leaked database.
Your password does not leave the page
The 10 characters are produced by code running in your browser and held only in the page's memory; closing or reloading the tab discards them. The site never uploads, logs or stores them.
How the characters are chosen
Random numbers come from crypto.getRandomValues, and rejection sampling removes the small bias a simple remainder would introduce, so each allowed character is equally likely and the bit count is exact. Read the methodology to see how to check the network activity of this page in developer tools.
FAQ
Is a 10-character password good enough?
For an account with a second factor and login limits, yes. As the sole protection for something that could be attacked offline, it is on the short side; 15 or 16 characters is the safer habit.
Is 10 characters with symbols better than 12 without?
No. Ten characters from all four types give about 62.5 bits; twelve letters and digits give about 71.5 bits. The extra two characters outweigh the symbols.
Why does my old work system reject lowercase letters?
Some systems, such as IBM i at password levels 0 and 1, treat passwords as uppercase only and allow a short list of symbols. Generate with only uppercase and digits enabled.
How much stronger is 10 than 8?
5,776 times more combinations with all four types, or about 12.5 extra bits. In practice that turns minutes into weeks at the fast-hash rates above.
Can I make the password easier to read without losing much?
Turn on look-alike exclusion. At 10 characters it costs about 1.2 bits, a small cost for never confusing O with 0 or l with 1.
Sources
- IBM Docs: Password Level (QPWDLVL), IBM i 7.5
- NIST SP 800-63B-4
- PCI DSS v4.0 SAQ C-VT (8.3.6)
- hashcat 6.2.6 RTX 4090 benchmark
Checked 2026-10-11.
Last updated: