The math says 12+ if randomly generated by something like a password manager and including uppercase, lowercase, numbers, and symbols. 95^12 is too big for pret

The math says 12+ if randomly generated by something like a password manager and including uppercase, lowercase, numbers, and symbols. 95^12 is too big for pretty much anyone to crack for a very long time, if ever. There is a small caveat to this regarding what type of hashing is being used though. In nearly all cases, even in the case of relatively weak hashes, 12+ is enough, but there are hashes which truncate or break up inputs. Windows LanMan(LM) is probably the most common offender still seen these days that does this and any LM will always be breakable up to 14 characters due to its underlying algorithm leading to a weak separation of 7 + 7 characters. In the case of Windows hashing a default length of 15+ can help to avoid LM being stored but for legacy systems it may be unavoidable.