Sixty-four characters drawn at random from capitals, small letters, digits and 14 symbols carry about 400 bits (the meter shows 399.9), far past anything a guessing attack could test. The number matters for other reasons: NIST and OWASP ask services to permit passwords of at least 64 characters, Windows LAPS tops out at 64, and in Wi-Fi a 64-character key is read as raw hexadecimal, so a 64-character password with letters and symbols cannot be used as a WPA2 passphrase.
Why 64 keeps coming up
Sixty-four is the number standards use when they tell services how long a password they must accept, not how long yours should be.
- NIST SP 800-63B-4 says verifiers should permit a maximum password length of at least 64 characters, must check the entire password rather than truncating it, and should take any printable ASCII character, spaces included.
- OWASP ASVS 5.0 includes the check "Verify that passwords of at least 64 characters are permitted." Its earlier version 4.0.3 went further and told applications to deny passwords of more than 128 characters, as a guard against very long inputs.
- Windows LAPS generates local administrator passwords of 8 to 64 characters, so 64 is its maximum.
A 64-character password is therefore the longest one you can expect a well-built service to take. Many services accept more; some accept less.
Generate a 64-character password
- Set the length to 64; all four character types are on.
- Press Generate; the entropy reads 399.9 bits.
- Keep it in your password manager, because nobody will type this by hand.
- Paste it into the site or system and complete the change.
- Sign out and test as described below to make sure the full 64 characters were kept.
Wi-Fi: why 64 is a different kind of key
WPA2-Personal accepts two forms of shared secret. One is a passphrase of 8 to 63 characters, which the access point and every device stretch into a 256-bit key using PBKDF2 with HMAC-SHA1, the network name as salt and 4,096 iterations. The other is the 256-bit key itself, written as exactly 64 hexadecimal digits (0–9 and a–f). Because a passphrase can be at most 63 characters, an entry of exactly 64 can only be the hex form. hostapd, the reference access point software used on Linux and in many routers, documents exactly these two forms in its sample configuration.
So a 64-character password from this page, with uppercase letters and symbols in it, will be refused or misread by a Wi-Fi setup screen. For Wi-Fi, use at most 63 characters; the Wi-Fi preset defaults to 20 and goes up to 63. If you really want to enter the raw 64-digit key, it has to be hex, which this generator does not produce.
More than 256 bits does not survive the trip
A password is rarely used directly. Systems run it through a hash or key derivation function that produces a fixed-size output, often 256 bits. Whatever goes in, there are only 2²⁵⁶ possible results, so an attacker can expect to find some input that produces the right one within about 2²⁵⁶ attempts, however long your actual password is. The Wi-Fi key derived from a passphrase is exactly that size.
That puts a natural cap on useful length. With this generator's full character set, 41 characters already exceed 256 bits. Sixty-four characters is far beyond the point where extra characters add security; the reason to use it is that a field allows it and you want a single, uniform policy for long machine secrets.
Some numbers anyway, using two assumed guessing speeds against a fast hash. Four RTX 4090 cards on NTLM reach roughly 10¹² tries a second; covering half of a 256-bit space at that pace takes about 1.8 × 10⁵⁷ years. A purely hypothetical 10¹⁸ tries a second shortens it to 1.8 × 10⁵¹ years.
bcrypt's 72-byte input limit
bcrypt, one of the most common password-hashing functions, reads at most 72 bytes of input in most implementations; anything after that is ignored. The OWASP Password Storage Cheat Sheet tells developers using bcrypt to enforce a 72-byte maximum for that reason. Every character this generator produces is one byte in UTF-8, so a 64-character password stays within the limit, with 8 bytes to spare. A 100-character password, on a site that uses bcrypt without guarding the length, might effectively be its first 72 characters.
Check that the site kept all 64 characters
NIST forbids truncation, but not every site follows NIST. You can test for it without risk:
- After setting the new password, sign out.
- Try signing in with only the first 63 characters, or the first 50. If that works, the site cut your password short and is checking only part of it.
- Sign in with the full 64 characters to confirm it works, then note the site's real limit in your password manager.
If the shortened version is accepted, the site is not keeping the full password; you may prefer a length that fits its real limit so you know exactly what protects the account.
Where 64 characters fit
- Password manager entries for services that accept long passwords, where length costs nothing.
- Secrets in automation where a policy says "maximum allowed length".
- Windows LAPS-style local admin passwords at their 64-character ceiling.
- Encryption passwords stored in a file or vault rather than typed.
Where 64 does not fit
- Wi-Fi passphrases, which stop at 63.
- Systems with shorter caps, such as Oracle Database at 30 bytes or MySQL replication passwords at 32 characters; see the 32-character page.
- Anything typed by a person, even occasionally. A long passphrase is the human-friendly way to get length.
Where the characters go
Nowhere. The page produces the password in your browser's memory and shows it to you; it does not upload, store, or log it, and leaving the page erases it.
Under the surface
All 64 characters are drawn with crypto.getRandomValues and rejection sampling, keeping each of the 76 characters equally likely. At this length virtually every random string already mixes all four types, so requiring them changes nothing visible in the 399.9 bits shown. The methodology page explains how to see for yourself that generating produces no network traffic.
FAQ
Will every site accept a 64-character password?
No, but sites following NIST or OWASP guidance should. If a site refuses it or shows an error, shorten the password until it is accepted and run the truncation test above.
Can I use a 64-character password for my Wi-Fi?
Not with letters and symbols. Wi-Fi treats exactly 64 characters as a hexadecimal key. Use 63 characters or fewer, for example with the Wi-Fi preset.
Is a 64-character password safer than a 32-character one?
Not in practice. Both are far beyond guessing, and most systems reduce the password to a 256-bit or smaller value anyway. Use 64 only where it is convenient.
What is the longest password this generator makes?
128 characters, matching the upper limit some services set to protect themselves from extremely long inputs.
Does a long password slow down sign-in?
Not noticeably. The slow part of password hashing is the repetition built into the algorithm on purpose, and that cost barely changes between 16 and 64 characters.
Sources
- NIST digital identity guidelines, authentication volume
- OWASP ASVS 5.0.0, V6.2.9
- OWASP ASVS 4.0.3, V2.1.2
- Windows LAPS policy settings
- hostapd example configuration
- wpa_passphrase source
- OWASP Password Storage Cheat Sheet
Checked 2026-10-11.
Last updated: