# 24-character password generator

> Twenty-four random characters across capitals, small letters, digits and symbols give about 150 bits (149.9 with one of each type required). The useful property of 24 is headroom: if a system forbids symbols you still have 143 bits, and lowercase letters with digits alone still give 124 bits. Twenty-four characters also fits under the length caps of systems such as Oracle Database (30 bytes) and WPA2 Wi-Fi (63 characters).

## Length as insurance against picky systems

Most advice about password length assumes you can use any character you like. In practice you often cannot. A database client may choke on quotes, an older web form may refuse anything outside letters and digits, a device may convert everything to uppercase, and a support agent may need to read the password over the phone. Each restriction shrinks the character set and takes bits away.

A 24-character password absorbs those losses. It starts well above the strength any guessing attack can touch, so even after removing whole classes of characters, it remains near or above the 128-bit level that NIST's key-management guidance treats as acceptable for the long term.

| What the system allows | Set size | Bits at 24 | Still at or near 128 bits? |
|---|---|---|---|
| All four types | 76 | 150.0 | Yes, by a wide margin |
| All four, look-alikes removed | 70 | 147.1 | Yes |
| Letters and digits only | 62 | 142.9 | Yes |
| Letters and digits, no look-alikes | 57 | 140.0 | Yes |
| Lowercase and digits, or uppercase and digits | 36 | 124.1 | Within 4 bits |
| Lowercase letters only | 26 | 112.8 | 15 bits short |
| Digits only | 10 | 79.7 | No; treat as a long PIN |

To put the weakest rows in perspective, picture a stolen, quickly computed hash and two labelled speeds: 10¹⁰ guesses a second (about what one RTX 4090 manages on plain SHA-256) and 10¹² a second (several of those cards chewing through MD5 or NTLM). A 24-digit numeric password still takes about 2 million years at the first rate and 16 thousand years at the second to search halfway. Every other row runs to 10¹⁴ years or more even at the higher rate.

## Make a 24-character password

1. Keep the length at 24 and the four character types on.
2. If the target system has character rules, switch off the types it rejects before generating.
3. Press Generate; with all types on, the meter shows 149.9 bits.
4. Store the password in your password manager or secrets vault under a clear name.
5. Paste it into the system and test a sign-in before you close the old session.

## How 24 sits against real length limits

The other half of the argument for 24 is that it fits. Some well-known maximums, all from vendor documentation:

| System | Documented limit | 24 characters fits? |
|---|---|---|
| Oracle Database user password | 30 bytes | Yes |
| MySQL replication source password | 32 characters | Yes |
| WPA2-Personal Wi-Fi passphrase | 8 to 63 characters | Yes |
| Windows LAPS generated password | 8 to 64 characters | Yes |
| bcrypt password hashing | 72 bytes of input | Yes |
| AWS IAM user password | up to 128 characters | Yes |
| Microsoft Entra ID cloud password | 8 to 256 characters | Yes |

Every character this generator produces is plain ASCII, one byte each, so 24 characters means 24 bytes wherever a limit is counted in bytes.

## Choosing between 20, 24 and 32

All three are beyond guessing, so the choice comes down to the systems you deal with. Twenty is enough when you control the character set and know nothing will strip symbols. Twenty-four is the better default when you manage many different systems and do not want to check each one's rules, because it survives the loss of symbols, mixed case or both. Thirty-two suits machine-to-machine secrets, but runs into a few documented caps; the [32-character page](/password-generator/32-character/) covers them. Pick one length per category and use it consistently, so a too-short password never slips through.

## Where 24 characters fit

- **Database and service accounts.** Application users for Oracle, MySQL and similar systems, where the password lives in a vault or a deployment secret.
- **Infrastructure admin accounts.** Hypervisors, routers, firewalls and storage boxes, whose web interfaces and command lines vary widely in what they accept.
- **Encrypted backups.** A backup tool's encryption password, stored in your password manager, where a forgotten character set restriction years later would be painful.
- **Team vaults.** Shared credentials that are pasted, never typed.

## Where 24 is the wrong tool

- **Memorized passwords.** Twenty-four random characters are not memorable; use a [passphrase](/passphrase-generator/) for anything you must recall.
- **Wi-Fi typed on televisions.** The length fits, but symbols and mixed case are slow with a remote; the [Wi-Fi preset](/password-generator/wifi/) is designed for that.
- **Systems capped below 24.** Fill the available length instead. The [10-character page](/password-generator/10-character/) describes one system that stops at 10.

## Nothing is sent or kept

The characters are produced in your browser by the page's script. They do not travel over the network, never touch browser storage, and vanish when the tab is closed.

## Notes on the generator

Each character comes from `crypto.getRandomValues`; rejection sampling keeps all allowed characters at identical odds. At 24 characters, 95.9% of random strings already contain all four types, so the "one of each" option changes the figure by only 0.06 bits. The [methodology page](/methodology/) explains how to confirm with developer tools that nothing leaves your device.

## FAQ


### Is 24 characters overkill?

For guessing alone, yes; 21 characters of all four types already pass 128 bits. The extra three characters are insurance for systems that make you drop symbols or mixed case.

### Why not just use 32 characters for everything?

Some systems cap below 32. Oracle Database, for example, limits passwords to 30 bytes. Twenty-four leaves a margin under most caps while staying far above any guessing threat.

### My system only accepts uppercase letters and digits. Is 24 still strong?

Yes. Thirty-six possible characters across 24 positions give about 124 bits, close to the 128-bit level and far beyond practical attack.

### Do symbols matter at this length?

Very little. Removing them costs about 7 bits at 24 characters, which still leaves 143. Keep them if the system accepts them; drop them if they cause trouble.

### Can I use a 24-character password for Wi-Fi?

Yes, WPA2 accepts up to 63 characters. For a password people will type on devices with awkward keyboards, use the Wi-Fi preset instead.

## Sources

- [Oracle Database 19c: Guidelines for Securing Passwords](https://docs.oracle.com/en/database/oracle/oracle-database/19/dbseg/guidelines-securing-passwords.html)
- [MySQL 8.4: CHANGE REPLICATION SOURCE TO](https://dev.mysql.com/doc/refman/8.4/en/change-replication-source-to.html)
- [hostapd.conf: WPA passphrase rules](https://git.w1.fi/cgit/hostap/plain/hostapd/hostapd.conf)
- [Microsoft Learn: Windows LAPS policy settings](https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-management-policy-settings)
- [OWASP Password Storage Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html)
- [AWS IAM: account password policy](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html)
- [Microsoft Entra: password policies](https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sspr-policy)
- [NIST SP 800-57 Pt. 1: key management](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf)

Checked 2026-10-11.

Last updated: 2026-10-17