Twelve random characters from uppercase, lowercase, digits and 14 symbols give about 75 bits, or 74.5 bits once the generator insists on every type. That meets PCI DSS 4.0 requirement 8.3.6, which since 31 March 2025 calls for at least 12 characters containing both letters and digits. Even an attacker running 10¹² guesses a second on a stolen MD5 or NTLM hash would spend about 428 years on half of them.
Why 12 shows up on so many policy documents
Twelve is the number in the Payment Card Industry Data Security Standard. Requirement 8.3.6 of PCI DSS 4.0 says that where passwords are used for authentication, they must be at least 12 characters long (or 8 if the system cannot support 12) and contain both numeric and alphabetic characters. It was a best practice until 31 March 2025 and has been mandatory since. The previous version, 3.2.1, asked for only 7. If you administer anything that touches cardholder data, 12 is your floor.
Twelve was also the minimum in version 4.0.3 of the OWASP Application Security Verification Standard, a widely used checklist for web applications. Version 5.0, released in 2025, set the hard floor at 8 but "strongly" recommends 15. Oracle's database security guide suggests passwords of 12 to 30 bytes containing letters and digits.
So 12 sits between two eras: long enough for most compliance checklists written in the last decade, and a few characters short of the newest guidance for passwords used on their own.
Generate a password that passes 8.3.6
- Keep the length at 12 and leave all four character types on.
- Leave the every-type option enabled; it ensures the letters and digits the standard asks for.
- Press Generate; the entropy should read about 74.5 bits.
- Set it as the account password and store it in your organization's approved password manager.
- Generate a fresh one for every system; the standard's length rule assumes passwords are not shared.
Four attack scenarios
The same 12 characters can be trivial or impossible to crack depending on what the attacker has. These are average times to find the password, assuming a stolen hash and full knowledge of the generator's settings.
| Scenario and guess rate | All four types, one of each | Letters and digits, one of each | Lowercase and digits |
|---|---|---|---|
| Slow salted hash, about 10⁴/s | 43 billion years | 4 billion years | 8 million years |
| Fast hash on one GPU, 10¹⁰/s | 43 thousand years | 4,478 years | 8 years |
| Fast hash on a GPU rig, 10¹²/s | 428 years | 45 years | 27 days |
| A hundred such rigs, 10¹⁴/s | 4 years | 164 days | 7 hours |
How the rates were chosen: the slow-hash row approximates a single RTX 4090 working on bcrypt hashes at cost factor 10; hashcat's published figure for that card is 184,000 hashes a second at cost 5, and five more cost steps mean 32 times the work. The fast single-GPU row is a little under half the 22 billion SHA-256 guesses per second that card reached. The rig row is four cards against NTLM. The last row is a hypothetical, well-funded attacker, included to show where 12 characters start to thin out.
An attacker guessing online fares far worse. NIST requires services to disable a password after no more than 100 consecutive failures. One hundred guesses against 2 to the power of 74.5 possibilities have a chance of roughly 4 in 10²¹.
Random 12 versus a 12 you made up
The table only applies to randomly generated characters. A human-made password of the same length, such as a season, a year and two exclamation marks, follows a pattern that cracking tools try early. Those passwords often fall in seconds no matter how the hash is stored, because the attacker never has to search the whole space. Twelve characters from this page carry the full 74.5 bits because there is no pattern to find.
Where 12 characters fit
- Staff and admin accounts on systems in scope for PCI DSS, alongside the multi-factor authentication the standard requires for administrative access to the cardholder data environment.
- Everyday website accounts filled in by a password manager, where 74.5 bits is comfortably beyond any realistic attacker of a leaked fast hash.
- Database user passwords on systems that follow Oracle's 12-to-30-byte guidance.
Where to go longer
- Password-only accounts under NIST rules. SP 800-63B-4 sets 15 characters as the minimum for a single-factor password; the 15-character preset meets it.
- Encryption keys you type. For a disk or archive password, a passphrase of six or more words is easier to type and stronger.
- Secrets that must last for years. Hardware keeps getting faster. Adding four characters (to 16) multiplies the work by more than 33 million.
Generated here, kept nowhere
This page makes the password locally in your browser. It does not send the result over the network, does not save it in cookies or browser storage, and forgets it when the tab closes.
Implementation
Character selection uses crypto.getRandomValues with rejection sampling, which keeps every allowed character at exactly equal odds. The "one of each" figure counts only the passwords that actually contain every selected type, so the meter never overstates. The methodology page describes how to verify the absence of uploads with your browser's developer tools.
FAQ
Does a 12-character password meet PCI DSS 4.0?
Yes, if it contains both letters and digits, which this preset ensures while the every-type switch is on. The standard also has rules on history, reuse and multi-factor authentication that a generator cannot handle for you.
Why does PCI DSS say 12 when NIST says 15?
They answer different questions. PCI DSS pairs its 12-character minimum with separate multi-factor requirements for access to cardholder data. NIST's 15 applies when the password is the only factor; with a second factor NIST accepts 8.
Are 12 random characters enough for a personal email account?
With a unique password and two-step verification turned on, yes. Your email is the reset route for other accounts, so many people choose 16 or more there anyway.
Do I need symbols for PCI DSS?
No. The requirement is letters and digits. Symbols add about 0.3 bits per character, so turning them off costs a little over 3 bits at this length.
Is it worth turning off look-alike characters?
Worth it whenever the password might be read aloud or copied by hand. At 12 characters it costs about 1.4 bits.
Sources
- PCI SSC: PCI DSS 4.0 self-assessment questionnaire (8.3.6)
- OWASP ASVS 4.0.3, V2.1.1
- OWASP ASVS 5.0.0 (JSON)
- Oracle Database 19c: Guidelines for Securing Passwords
- NIST SP 800-63B-4
- Hashcat RTX 4090 benchmark
Checked 2026-10-11.
Last updated: