A random 24-character password is very strong — useful for service accounts and shared vault entries. With all 94 printable characters it has about 157 bits of entropy. Use the generator above — it opens at 24 characters, and you can still adjust the length if a site needs something different.
When to use 24 characters
Once humans no longer type a password, there is no reason to keep it short. Twenty-four characters is a common standard for service accounts, database users, SMTP relays, CI/CD secrets and shared entries in team password vaults. At about 157 bits it exceeds the strength of a 128-bit encryption key with plenty to spare.
Watch out for special characters in config files
Machine credentials often end up in .env files, YAML, connection strings and shell scripts, where characters like $, #, ", ', @ and : can break parsing or need escaping. If that is a concern, untick symbols — 24 letters and digits still give about 143 bits — or use the bulk generator, which lets you exclude specific characters.
Rotate when people leave
NIST discourages scheduled rotation for personal passwords, but shared service credentials should be changed when someone with access leaves the team, or if a secret is exposed in logs or a repository.
How strong is a 24-character password?
The table shows how many different 24-character passwords exist for each character set, and how long an offline attacker testing 100 billion guesses per second (a multi-GPU rig against a fast hash such as MD5 or NTLM) would need on average to find a randomly generated one.
| Character set | Possible passwords | Entropy | Average time to crack |
|---|---|---|---|
| Numbers only (0–9) | 1.0 × 1024 | 80 bits | about 158,440 years |
| Lowercase letters | 9.1 × 1033 | 113 bits | far longer than the age of the universe |
| Letters (A–Z, a–z) | 1.5 × 1041 | 137 bits | far longer than the age of the universe |
| Letters + numbers | 1.0 × 1043 | 143 bits | far longer than the age of the universe |
| All printable characters | 2.3 × 1047 | 157 bits | far longer than the age of the universe |
These figures assume the password is truly random. A 24-character password built from a word, a name or a date can be cracked in a tiny fraction of this time. Check any password with the strength checker.
Other password lengths
- 8 characters
- 10 characters
- 12 characters
- 14 characters
- 15 characters
- 16 characters
- 20 characters
- 24 characters
- 32 characters
- 64 characters
Last updated: · Reviewed by the Password Generator team