The United States Department of Defense recommends that passwords consist of 8 or more characters. When you specify a password length, consider a longer password if security is critical. However, keep in mind that because it is more difficult to remember a longer password, the user is more likely to write it down rather than memorize it, and users should not write down passwords.