ASVS V6.2.1 requires that user set passwords are at least 8 characters long, and strongly recommends a minimum of 15. It is a Level 1 requirement.
Length is the single best predictor of how long a password survives offline guessing. Aim for 15 where your users and product allow it.
Think of length as the main knob you control. Fifteen characters is a good default for consumer and business applications, and eight is the floor you only accept when you have a documented reason.
Why it matters
Short passwords fall to dictionary and brute force attacks once a hash database leaks. Every extra character multiplies the work for the attacker, while for the user it is just a longer phrase.
Offline cracking speeds have grown with cheap GPUs. An eight character password drawn from typical human choices can fall within hours against a fast hash. A fifteen character passphrase, even a simple one, moves the cost far beyond what most attackers will spend on a single account.
Length rules are also the least annoying rule you can set. People can use a favorite line from a song or a few unrelated words, and they do not need to invent symbol substitutions.
How to implement it
Enforce the rule on the server. A client side check is only a convenience.
MIN_LEN = 15
def validate_length(pw: str) -> str | None:
if len(pw) < MIN_LEN:
return f"Use at least {MIN_LEN} characters."
return None
Count characters, not bytes, so a user typing in another script is not penalized. See V6.2.9 for the matching upper bound.
Set the rule once in a shared validation module and call it from registration, change and reset. Return a message that names the requirement. Test that the API enforces the rule even if the front end is bypassed. When you raise the minimum, apply it to new passwords only. Do not force existing users to reset just for length, but do encourage it.
How to test it
Submit a 7 character, 8 character and 14 character password at registration and password change. With a minimum of 15, all three must be refused by the API, not just the form. Confirm the same rule on the reset flow.
Automate the cases as unit tests with the boundary values: one character below the minimum, exactly the minimum, and one above. Run them against registration, change and reset, so a future refactor cannot drop the rule on one path.
Common mistakes
-
Enforcing length only in JavaScript.
-
Measuring bytes instead of characters.
-
Adding composition rules that make short passwords look strong.
-
Applying the rule at signup but not at reset.
-
Raising the minimum in the web UI while the mobile API still accepts 6 characters.
-
Counting characters after trimming, which turns padded input into a short password.
Quick check
Is 8 acceptable at Level 1?
It meets the minimum, but ASVS strongly recommends 15 and you should choose that if you can.
