NIST SP 800-63B-4, final since August 2025, says a password used as a single-factor authenticator must be at least 15 characters; with a second factor the minimum is 8. Fifteen random characters with this generator's default settings give about 93.7 bits, or 93.5 bits with one of each type. Chrome's built-in generator also defaults to 15 characters.
The number in the 2025 NIST guidelines
NIST's Digital Identity Guidelines are the reference most US agencies, many companies and a lot of software vendors follow for passwords. The fourth revision, SP 800-63-4, replaced the 2017 version on 1 August 2025. Its authentication volume, SP 800-63B-4, changed the headline length rule: verifiers must require passwords to be at least 15 characters long when the password alone authenticates the user. Only when the password is part of multi-factor authentication may the minimum drop to 8.
The same section sets several other rules that matter when you generate a password:
- Verifiers should allow passwords of at least 64 characters, and must check the whole password rather than cutting it short.
- Every printable ASCII character, spaces included, ought to be allowed, and Unicode too.
- They must not impose composition rules such as "one uppercase, one symbol", and must not force periodic changes without evidence of compromise.
- They must compare new passwords against a blocklist of common, expected or breached passwords.
- They must allow no more than 100 consecutive failed attempts before disabling the password.
OWASP's ASVS 5.0, the checklist many web teams test against, lines up with this. Its minimum is 8 characters, but it says a minimum of 15 is "strongly recommended".
Generate a 15-character password
- Keep the length at 15; all four character types are on.
- Decide on the "one of each type" option: a NIST-aligned site does not need it, but many older sites still check.
- Press Generate and confirm the entropy, about 93.5 to 93.7 bits.
- Enter it on the site and keep a copy in your password manager.
- If the site offers a second factor, add it as well; the password then has even more margin than it needs.
Fifteen characters from different generators
Browsers and system tools each pick their own character sets, so "15 characters" means different strengths. Chrome's password generator defaults to 15 characters drawn from letters and digits with look-alike characters (0, 1, O, o, I, l) removed and no symbols, and requires at least one lowercase letter, one uppercase letter and one digit.
Times below are averages for an offline search after a hash leak. The guess rates are assumptions: 10¹⁰ per second is about half of what one RTX 4090 managed on unsalted SHA-256 in a published hashcat benchmark; 10¹² per second is a small rig of those cards against MD5 or NTLM.
| Generator setting at 15 characters | Bits | At 10¹⁰ guesses/s | At 10¹² guesses/s |
|---|---|---|---|
| Lowercase only, for comparison | 70.5 | 2,657 years | 27 years |
| Chrome default (56 characters, mixed) | 87.0 | 238 million years | 2 million years |
| This page, letters and digits | 89.3 | 1 billion years | 12 million years |
| This page, look-alikes removed | 91.9 | 8 billion years | 75 million years |
| This page, one of each of four types | 93.5 | 21 billion years | 215 million years |
All of these are far beyond reach for a random password, which is the point of the NIST rule: at 15 random characters, the guessing question is closed, and what remains is phishing, reuse and how carefully the service stores your password.
Fifteen is also where some old problems end
Windows can still store a weak LAN Manager hash for passwords up to 14 characters on systems configured to keep it; at 15 or more, no usable LM hash exists. Raising a Windows domain's minimum to 15 requires the "Relax minimum password length limits" setting, available since Windows Server version 2004, because the classic policy stops at 14. The 14-character page covers those Windows details.
Composition rules versus the "one of each" switch
If NIST forbids composition rules, why does this generator offer one? Because NIST tells services what they may demand of you, not what a generator may produce. Many sites still reject a password without a digit or a symbol, and a random 15-character string lacks at least one of the four types about 17% of the time. Keeping the option on spares you a rejected form. The meter accounts for it honestly: requiring every type removes those 17% of combinations, which costs about 0.27 bits at this length.
Where 15 characters fit
- Any account protected by a password alone, on a service that follows NIST or simply asks for "at least 15".
- Work accounts in organizations adopting SP 800-63B-4, where 15 will become the policy minimum.
- Accounts where you cannot turn on two-step verification.
Where 15 is more than needed, or not enough
With a second factor in place, NIST is satisfied by 8, though a longer password costs nothing when a manager fills it in. For the one password that unlocks your vault, or a disk you encrypt, which you must type and an attacker may test offline, a six-word passphrase is easier to type and remember.
No copy leaves your device
The password is made right here in the browser tab, held in memory only while the tab is open, and never sent to a server or saved to storage. Generating a new one replaces the old one on screen.
How it is built
The generator reads random bytes from crypto.getRandomValues and maps them to characters with rejection sampling, discarding the few values that would make some characters more likely than others. That uniformity is what makes the bit figures exact. Details and a do-it-yourself network check are on the methodology page.
FAQ
Does NIST require 15-character passwords for everyone?
Services that follow the guidelines must demand at least 15 characters whenever no other factor is involved. With multi-factor authentication, the minimum is 8. NIST does not regulate what you choose beyond that.
When did the minimum change from 8 to 15?
With SP 800-63-4, which became final in August 2025. The 2017 revision required at least 8 characters for passwords chosen by users.
Is Chrome's 15-character password as strong as this one?
Close. Chrome's default set has 56 characters and no symbols, giving about 87 bits; this page's default gives about 93.5. Both are well beyond guessing attacks.
Will a site that follows NIST reject my generated password?
Only if it appears on the site's blocklist of common or breached passwords, which is practically impossible for a random 15-character string. Generate another if it ever happens.
Should I use spaces since NIST says they are allowed?
The generator does not include spaces because many older sites still reject or trim them. If you want spaces, a passphrase is the natural place for them.
Is 15 enough for a Wi-Fi network?
For a random password, yes in terms of entropy, but the Wi-Fi preset uses 20 characters without symbols so it is easier to type on televisions and game consoles.
Sources
- NIST SP 800-63B-4: password verifiers and rate limiting
- NIST SP 800-63B (2017), superseded notice
- OWASP ASVS 5.0.0, V6.2.1
- Chromium source: password_generator.cc
- Microsoft Learn: Passwords technical overview
- hashcat benchmark, RTX 4090
Checked 2026-10-11.
Last updated: