SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/sec-password-16-chars

CISA says a strong business password should be at least how long?

At least 16 characters, and longer is better.

Start playing free

  1. 16 characters ✔
  2. 8 characters
  3. 12 characters

Why: Length is what makes a password hard to guess. CISA tells businesses to use long, random, unique passwords, and a password manager can create and remember them so nobody has to.

Huh, didn't know that: CISA also says providing a company password manager makes it easier for employees to use strong passwords.

The dad joke
My computer said my password is insecure. Well, maybe if it wasn't forced to have such strict requirements.
Like this card?
Play the game

References

Answer: 16 characters. Length is what makes a password hard to guess. CISA tells businesses to use long, random, unique passwords, and a password manager can create and remember them so nobody has to.

  1. CISA: Require Strong Passwords www.cisa.gov/secure-our-world/require-strong-passwords
    at least 16 characters long (even longer is better)
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyHow many accounts should each password be used for, according to CISA?Security & PrivacyWhat does current NIST guidance say about forcing symbols and capital letters in passwords?Security & PrivacyNIST says a password used as the only login factor should be at least how long?

That's stuff everyone should know.