Length is not a security metric. Use Min-Entropy to measure how unpredictable a password, key, or token really is — and how long it would take an adversary with 10⁶ to 10¹² guesses/sec to crack it.