32 character password
A length for things a program types, not a person: access keys, application secrets, service account passwords.
Space — new password · C — copy · M — hide
Password length
Character sets
Select at least one character set.
Passphrase settings
A 2048-word list gives exactly 11 bits per word (the Diceware method). Six words are 66 bits, eight are 88. The words are drawn by a cryptographic generator, not by a human — that is the whole point.
Password pattern
a — lowercase, A — uppercase, L — any letter, 9 — digit, # — symbol, X — letter or digit, * — any enabled character, c/v — consonant/vowel. Every other character is copied as is, \ escapes the next one.
Fine tuning
“Safe symbols only” keeps !@#$%^&*_-+=? — almost every site accepts them and they do not break shell commands, CSV or SQL.
Recent passwords (this tab only)
What happens to your password
The password is assembled in your browser from the cryptographic randomness source crypto.getRandomValues with rejection sampling, so every character is equally likely.
The page never sends passwords to a server, never writes them to browser storage and drops the history when the tab closes.
Password letter by letter
Phonetic spelling for reading a password out over the phone. Letter case is stated separately.
Where this length is needed
See the questions below for details.
Beware of truncation
See the questions below for details.
Questions
Frequently asked questions
Why would anyone need this length?
Not for typing but for values a program supplies: an API access key, an application secret, a service account password, an environment variable. Length costs nothing there, because nobody will ever type it.
How many bits is that?
About 210 with the full character set — a number beyond practical meaning. The value is not extra unguessability, which sixteen characters already had, but that such a key survives any future tightening of requirements.
Could this break a system?
Sometimes. Old systems silently truncate long passwords, so you believe you are protected by 32 characters while only eight are stored. Test it: change the password, then try logging in with only its first half. If it works, the password is being truncated.
Which characters should I use?
For keys that end up in configuration files and command lines, letters and digits only are safer: punctuation is read there as separators. For ordinary accounts use the full set.
Next