The 8 4 rule for passwords is a traditional guideline for creating stronger login credentials. It means your password should:
- Contain at least eight characters
- Include four character types: uppercase letters, lowercase letters, numbers, and special characters
For example, a password following the rule would contain a mix similar to A, b, 7, and ! across at least eight total characters.
The 8 4 rule can improve a weak password, but it should be treated as a minimum starting point. Modern security recommendations favor longer, unique passwords rather than relying only on password complexity.
What Does the 8 4 Rule for Passwords Mean?
The number 8 refers to password length. The number 4 refers to the four types of characters used within the password.
The “8” Refers to Password Length
Under the traditional rule, every password should contain at least eight characters.
A character can be a letter, number, symbol, or space when the website allows spaces. Every item you type counts toward the total password length.
Although eight characters may satisfy some account requirements, it is no longer considered an ideal target. Current NIST guidance requires a minimum of 15 characters when a password is the only authentication factor. CISA recommends creating passwords that are at least 16 characters long.
The “4” Refers to Password Complexity
The password should include at least one character from each of these four groups:
- Uppercase letters, such as A or B
- Lowercase letters, such as a or b
- Numbers, such as 4 or 8
- Special characters, such as !, @, or #
This is what gives the rule its name: at least eight characters containing four character types.
The phrase is sometimes used differently, but when discussing password creation, this is its most common meaning.
How to Create a Strong Password Using the 8 4 Rule
You can apply the rule in a few simple steps.
1. Use More Than the Minimum Password Length
Do not stop as soon as you reach eight characters. Aim for at least 15 or 16 characters.
One practical option is to combine several unrelated words into a passphrase. This can create a longer password that is easier to remember than a short string of random characters.
For example, you might combine unrelated concepts such as:
River + Lantern + Bicycle + Coffee
Do not use this exact example as your password. Create your own combination that is not based on a familiar quote, song lyric, or common phrase.
2. Include the Four Character Types
Add uppercase letters, lowercase letters, numbers, and special characters when the account requires them.
Avoid making the changes too predictable. Adding 1! to the end of a common word may satisfy a password complexity requirement, but it does not necessarily create a strong password.
3. Create a Unique Password for Every Account
Never reuse the same password across multiple websites.
When one website experiences a data breach, attackers may test the stolen login information on email, banking, social media, and business accounts. A unique password limits the damage to a single account.
4. Store Your Passwords in a Password Manager
A password manager can generate and securely store long, random passwords for each account. This removes the need to memorize dozens of different credentials.
CISA recommends using a password manager to create long, random, and unique passwords.
Does the 8 4 Rule Create the Most Secure Passwords?
No password rule can guarantee complete security. The 8 4 rule is also based on older standards that placed significant emphasis on mixing character types.
A password can technically follow the rule and still be weak. Consider a predictable structure such as:
Password1!
It includes eight or more characters, uppercase and lowercase letters, a number, and a special character. However, it is based on a common word and uses an obvious pattern.
The most secure passwords are long, random, unique, and not based on personal information. They should also be supported by multifactor authentication whenever it is available.
Password Strength vs. Password Complexity
Password strength and password complexity are related, but they are not the same.
What Improves Password Strength?
The most important factors include:
- Length
- Randomness
- Uniqueness
- Avoiding common or compromised passwords
- Avoiding personal information
A longer password gives an attacker more possible combinations to test. A unique password also prevents one compromised account from exposing your other accounts.
Why Password Complexity Is Not Enough
Password complexity refers to using different character types. It can increase the number of possible combinations, but it cannot fix a short or predictable password.
Modern NIST guidance does not recommend forcing users to follow character-composition rules. Instead, it emphasizes longer passwords and checking new passwords against lists of common or compromised credentials.
A More Secure Password Rule to Follow Today
The 8 4 rule remains a useful introduction to password security, but you should go beyond it.
For stronger protection:
- Use at least 15 or 16 characters
- Create a different password for every account
- Use random characters or several unrelated words
- Include special characters when required
- Avoid names, birthdays, addresses, and company names
- Store your credentials in a password manager
- Enable multifactor authentication
These practices provide better security than simply meeting an eight-character minimum.
Common Password Security Mistakes to Avoid
Stopping at Exactly Eight Characters
Eight characters may meet an older password rule, but longer passwords provide better protection.
Using Personal Information
Avoid including your name, birthday, pet’s name, address, employer, or other information that someone could find online.
Reusing Passwords
A strong password becomes much less secure when it is used for several accounts.
Using Predictable Special Characters
Attackers know that people commonly place ! at the end of passwords or replace letters with similar numbers and symbols. Use genuine randomness rather than obvious substitutions.
Examples of the 8 4 Rule in Practice
summer12 does not follow the rule because it lacks an uppercase letter and special character. Summer12! follows the 8 4 rule, but it is still predictable. A stronger option is River7!Cactus92 because it is longer and combines unrelated words, uppercase and lowercase letters, numbers, and special characters. Do not use these exact examples for your accounts.
Strengthen Password Security With MFA and a Password Manager
Even a strong password can be stolen through phishing or a data breach. MFA, also called multi-factor authentication, requires an additional form of authentication, such as an app notification, security key, or fingerprint. According to CISA, accounts using MFA are 99% less likely to be hacked.
A password manager improves password management by generating and storing unique credentials for every account. Password managers also reduce the temptation to reuse simple passwords. Use a reputable manager alongside MFA so a stolen password alone is not enough to access your account.
Frequently Asked Questions
What Are the Four Types of Characters in the Rule?
The four character types are uppercase letters, lowercase letters, numbers, and special characters.
Is an Eight-Character Password Secure?
An eight-character password may meet some minimum requirements, but modern guidance recommends longer passwords. Aim for at least 15 or 16 characters.
How Long Should a Strong Password Be?
NIST recommends a minimum of 15 characters when the password is used as the only authentication factor. CISA recommends at least 16 characters.
Does Password Complexity Improve Security?
Complexity can help, but it is not enough by itself. Length, uniqueness, and randomness have a greater effect on password strength.
What Is the Most Secure Way to Manage Passwords?
Use a reputable password manager to create and store a long, unique password for every account. You should also enable multifactor authentication for an additional layer of security.
Why Are Short Passwords Easier to Crack?
Passwords that are too short yield fewer possible combinations for attackers to test. This makes them more vulnerable to brute-force attacks, which automatically try large numbers of potential passwords.
Should I Use Personal Information in a Password?
No. Don’t use names, birthdays, addresses, pet names, or company information. Attackers can often find these details online and use them in dictionary attacks designed to test common words and predictable variations.
Are Long Passwords Better Than Complex Passwords?
In most cases, long passwords are harder to crack than short credentials with predictable substitutions. A complex password can still be weak when it is based on a common word or reused across accounts.
How Do I Create Passwords That Are Easy to Remember?
Use passphrases made from several unrelated words. This approach can help you create passwords that are longer and easier to remember without relying on personal information.
What Is a Good Basic Password Rule?
As a password basic guideline, use a unique password – preferably at least 15 or 16 characters long – for every account. Store it in a password manager rather than trying to memorize every credential.
Can Strong Passwords Prevent Every Cyber Threat?
Strong passwords reduce the risk of unauthorized access, but they cannot stop every cyber threat. Use MFA, account monitoring, and updated security software to create a more complex defense against phishing and stolen credentials.
