Fourteen randomly chosen characters out of 76 give about 87.5 bits, or 87.2 bits with one of each type required. Fourteen is a Windows number: Group Policy's minimum password length only goes from 0 to 14 unless a newer setting relaxes it, the old LAN Manager hash handled at most 14 characters, and Windows LAPS generates 14-character administrator passwords by default.
Why Windows keeps landing on 14
If you manage Windows machines, you have met this number three times.
The policy ceiling. The "Minimum password length" setting in Group Policy accepts values from 0 to 14. Microsoft's reference for the setting says a minimum above 14 "isn't supported at this time" unless you use a newer control. Since Windows 10 and Windows Server version 2004, a setting called "Relax minimum password length limits" (RelaxMinimumPasswordLengthLimits) lets administrators raise the minimum up to 128 characters. Without it, 14 is the most a domain can demand.
The LM hash. LAN Manager, the hash format Windows inherited from its early networking days, pads or cuts every password to exactly 14 characters, converts it to uppercase and splits it into two 7-character halves that are hashed separately. Microsoft describes the result as relatively weak and prone to fast brute-force attack, since each half can be cracked on its own. A password of 15 or more characters cannot produce a usable LM hash at all. LM storage has been off by default since Windows Vista and Windows Server 2008, but the 14-character limit shaped password rules for years.
The LAPS default. Windows LAPS, Microsoft's tool for rotating the local administrator password on every machine, generates 14-character passwords unless told otherwise, and can be configured anywhere from 8 to 64.
Generate a 14-character password
- Keep the length at 14; capitals, small letters, digits and symbols are all enabled.
- Leave "at least one of each type" on, which satisfies Windows' "Password must meet complexity requirements" policy.
- Press Generate and check the entropy, about 87 bits.
- Set the password on the account and record it in your password manager or vault.
- If the account is a domain account, confirm your domain policy has no maximum that truncates it.
Fourteen characters against the Windows hash
Modern Windows stores passwords as NT hashes (also called NTLM hashes), which are fast to compute and unsalted. That makes them a realistic worst case for an offline attack after a domain controller or a local SAM database is copied. The assumed guess rates below come from a published hashcat benchmark in which one RTX 4090 tested about 288 billion NTLM guesses per second:
- One card: 2.9 × 10¹¹ guesses per second.
- Four-card rig: 1.15 × 10¹² guesses per second.
The comparison uses Microsoft's own LAPS character options at 14 characters, with this generator's sets beside them. Times are to search half of all possibilities.
| 14 characters drawn from | Bits | One card | Four cards |
|---|---|---|---|
| LAPS setting 1: uppercase only | 65.8 | 4 years | 324 days |
| LAPS setting 2: upper and lower | 79.8 | 58 thousand years | 15 thousand years |
| LAPS setting 3: letters and digits | 83.4 | 681 thousand years | 170 thousand years |
| LAPS setting 5: readable set (64) | 84.0 | 1 million years | 266 thousand years |
| This page, look-alikes removed (70) | 85.8 | 4 million years | 931 thousand years |
| This page, one of each type (76) | 87.2 | 9 million years | 2 million years |
| LAPS setting 4, the default (82) | 89.0 | 34 million years | 9 million years |
LAPS setting 4 uses 20 symbols, including brackets, parentheses, commas and slashes, which this generator leaves out because they cause trouble in scripts and forms. Its default comes out about 1.9 bits ahead at the same length. Adding one character here more than closes the gap: 15 characters with every type give 93.5 bits.
Where 14 characters fit
- Local administrator and service accounts in a Windows environment, generated per machine and stored in a vault, much as LAPS does.
- Domain user accounts where the policy minimum is set to its traditional maximum of 14 and the password is filled in by a manager.
- Any account that also uses a second factor, where 87 bits is far more than the guessing threat calls for.
Where to add one more character
- NIST-aligned services where the password is the only factor. SP 800-63B-4 sets a 15-character minimum for single-factor passwords. Fourteen falls exactly one short; switch to the 15-character preset.
- Environments with old systems that still store LM hashes. A password of 15 or more characters avoids a usable LM hash entirely, which Microsoft lists as the simplest way to keep one from being stored.
- Domain controllers enforcing longer minimums. If your administrators have enabled the relaxed limit and raised the minimum, 14 may no longer pass.
What happens to the password on this page
It is generated inside your browser and nowhere else. The page does not transmit the characters, does not save them, and keeps no history, so closing the tab erases them.
Generator details
Each of the 14 positions is filled using crypto.getRandomValues, with rejection sampling so no character is favored. When the every-type rule is active, the meter counts only passwords containing every selected type, 80.3% of all 14-character strings. Confirming that nothing is sent takes a minute; the methodology page shows how.
FAQ
Why can't I set a Windows minimum password length above 14?
Older Windows versions cap the setting at 14. On Windows 10 or Windows Server version 2004 and later, enable "Relax minimum password length limits" and you can set a minimum up to 128.
Does a 14-character password still create an LM hash?
Only if LM storage is enabled, which it has not been by default since Windows Vista and Server 2008. Passwords of 15 or more characters never produce a usable LM hash.
Will this password meet Windows complexity requirements?
Yes, with "one of each type" on. The policy asks for characters from at least three of five categories (uppercase, lowercase, digits, symbols, and other Unicode letters). This password contains four of them, and all 14 of the generator's symbols are on Windows' list of special characters.
Is 14 characters enough for a domain admin account?
The guessing math says yes, but admin accounts warrant a second factor and, if your policy allows, a longer password such as 20 characters.
Why does LAPS generate stronger 14-character passwords than this page?
Its default symbol list has 20 characters against this page's 14, which adds about 1.9 bits at this length. The difference is small; use 15 characters here to pass it.
Sources
- Microsoft Learn: Minimum password length
- Microsoft Learn: Password must meet complexity requirements
- Microsoft Support: minimum password length auditing and enforcement
- Microsoft Learn: Passwords technical overview
- Microsoft Learn: Prevent Windows from storing an LM hash
- Microsoft Learn: Windows LAPS passwords and passphrases
- RTX 4090 hashcat benchmark (v6.2.6)
Checked 2026-10-11.
Last updated: