Thirty-two random characters from all four types carry about 200 bits; with letters and digits only, about 190.5. That is more than any guessing attack can approach, so the practical questions at this length are compatibility ones. MySQL rejects replication passwords longer than 32 characters, and Oracle Database limits passwords to 30 bytes, so a 32-character password does not fit there.
Secrets that machines read
Thirty-two is a length people associate with keys and tokens rather than passwords. Many API keys are 32 hexadecimal characters, and a version-4 UUID is written as 32 hex digits plus hyphens. Those strings carry at most 128 bits, because hex has only 16 symbols. Thirty-two characters from this generator carry far more, since each position has up to 76 options.
The typical home for a 32-character password is a file or a variable, not a human memory: a database connection setting, a .env file, a CI/CD secret, a backup job, or the password for a service account that only another program uses. In those places nobody minds the length, but the characters themselves can cause trouble.
Generate a 32-character secret
- Keep the length at 32.
- Decide on symbols: turn them off if the secret will go into a shell command, a URL or an unquoted config value.
- Press Generate and confirm the entropy: 199.9 bits with symbols, about 190 without.
- Paste the value into your secrets manager or the configuration, wrapped in quotes if the format calls for them.
- Restart or reload the service and confirm it can still authenticate before discarding the old secret.
Symbols that break things in config files
This generator's symbol set is ! # $ % & * + - = ? @ ^ _ ~. Brackets, quotes, backslashes and spaces are already excluded, but several of the remaining symbols have special meanings in common places:
| Where the secret goes | Symbols that can misbehave | What happens |
|---|---|---|
| POSIX shell, unquoted or in double quotes | $ ! & * ? ~ |
Variable expansion, history expansion, background jobs, filename globbing, home directory expansion |
| URLs and connection strings | @ # ? % & = + |
Ends the user part, starts a fragment or query, or is read as an encoded byte; each must be percent-encoded |
INI, .env and YAML files |
# and sometimes = |
# can start a comment and silently cut the value short when unquoted |
| Regular expressions and templates | $ ^ * + ? |
Interpreted as pattern or placeholder syntax |
The safe options are to quote and escape correctly for each format, or to turn symbols off. Without symbols, 32 characters from letters and digits still give about 190.5 bits, and the no-symbols preset explains the trade in more detail. Hyphen and underscore rarely need quoting anywhere; the other twelve are the ones to watch.
The 30- and 32-character limits
Thirty-two happens to sit right at two documented database limits.
MySQL replication. The password given to CHANGE REPLICATION SOURCE TO with SOURCE_PASSWORD may be at most 32 characters. MySQL's manual says that trying a longer one makes the statement fail. A 32-character password fits exactly; a 33-character one does not.
Oracle Database. Oracle's security guide recommends passwords of 12 to 30 bytes and notes that the maximum length "is currently limited to 30 bytes". A 32-character password is two bytes too long. Set the length to 30 for Oracle accounts, which still gives about 187 bits with all four types or 179 with letters and digits.
How much 200 bits is
Guessing times are meaningless at this length, but for completeness, suppose the secret leaks as a fast, unsalted hash. At an assumed 10¹² guesses per second (a few current GPUs on MD5 or NTLM), searching half the space of a 32-character, all-types password would take about 2.4 × 10⁴⁰ years. Grant the attacker 10¹⁸ per second instead, far beyond any machine known to exist, and it still takes about 2.4 × 10³⁴ years. Even the 128-bit hex token mentioned above would take 5.4 × 10¹⁸ years at 10¹² per second.
So length beyond 21 or 22 characters adds no practical guessing resistance. Its value is consistency: a team that uses 32 characters for every machine secret never has to wonder whether one of them was made too short.
Where 32 characters fit
- Database users for applications, except on Oracle, where 30 is the ceiling.
- Service accounts and automation credentials stored in a vault.
- Shared secrets between two systems, such as a webhook signing secret entered in two dashboards.
- Encryption passwords for automated backups, where the password is read from a file.
Where it does not
- Anything typed regularly by a person; use a passphrase or the 16-character preset.
- Wi-Fi networks shared with guests; the Wi-Fi preset is easier to type.
- Systems with documented caps below 32; check before you rotate a secret in production.
Local only
The secret is generated by JavaScript in this browser tab and is not uploaded, stored or logged. Copy it into your vault before leaving the page, because the page does not keep it.
Generation method
Characters are drawn using crypto.getRandomValues, and rejection sampling discards the random values that would otherwise make some characters more frequent than others. The figure on screen is therefore exact. At this length the one-of-each rule excludes only about 1.2% of combinations, so the meter's 199.9 bits matches length × log2(76) to the first decimal. More on how to check the page's network behavior is on the methodology page.
FAQ
Why does Oracle reject my 32-character password?
Oracle Database limits passwords to 30 bytes. Generate 30 characters instead; all characters here are single-byte ASCII, so 30 characters equal 30 bytes.
What happens if a MySQL replication password is longer than 32 characters?
According to the MySQL manual, the CHANGE REPLICATION SOURCE TO statement fails. Thirty-two characters is the maximum.
Should I use hex instead?
Only if a system requires hex. A 32-character hex string holds 128 bits; 32 characters of letters and digits hold about 190.5 bits and are just as easy to paste.
Is a 32-character password safer than a 24-character one?
Not in any practical sense; both are far beyond guessing attacks. Choose based on what the system accepts and what your team uses as a standard.
How do I put a password with symbols into a connection URL?
Percent-encode each special character, for example @ as %40 and # as %23, or generate the secret with symbols turned off.
Sources
- MySQL 8.4 Reference Manual: CHANGE REPLICATION SOURCE TO
- Oracle Database Security Guide 19c: securing passwords
- RFC 3986: URI generic syntax
- hashcat RTX 4090 figures
Checked 2026-10-11.
Last updated: