This question already has an answer here:

Why are we recommended to have at least 8 characters, and not 6 or 7 etc.? and the different set of character?. I only know that the longer the password is, the harder it is for brute force attack to take place. But why specifically 8 characters

marked as duplicate by A. Hersean, schroeder Jan 28 at 10:59

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 2
    Frankly, because various standards called for 8 characters. – schroeder Jan 27 at 21:29
  • The better question is why not 10, 12, or 14... We are to the point where we really should be storing our passwords in a manner that supports using passphrases rather than passwords, and we should be using dictionaries for our passphrases that are a lot more than 8000 words. But for the fact that it's been posted online, cwm thrash hudsUcker tangerine Betelgeuse anthrAx r!pple might be a good password today - but it doesn't do much good if your passwords are stored as MD5 hashes, because they're only 128 bits, and even if you count just 3 bits per char, that's 171. – Ed Grimm Jan 28 at 0:17
  • @Xenos yes, standards have changed, but I said that the standards called for. Many standards have been changed. – schroeder Jan 28 at 9:43
  • @A.Hersean I see it now. – schroeder Jan 28 at 10:59
  • @Sky the end of the duplicate's accepted answer explains the original reason why passwords were suggested to be 8 characters long: it was the maximum length of effective hashing of the original password hashing process. You could go longer than 8, but it didn't matter, so 8 as a minimum was the most secure password you could get. – schroeder Jan 28 at 11:02

You're right to state that password length recommendation is usually directly related to how hard it is to bruteforce attack it. When you combine this with the understanding that sophistication of attacks as well as computing power are increasing, it should follow that at some point in the past, based on computing power available, 8 characters was the "right" recommendation, and prior to this it could have been 6 or 7. Neither are the right recommendation today.

As computing power increases and sophistication of attacks increases, recommended password lengths will increase as well, to a point where it isn't feasible to use passwords which are any longer.

Not the answer you're looking for? Browse other questions tagged or ask your own question.