20-Character Password Generator

For accounts stored in a password manager, there is no such thing as overkill — length is free when you never type it. A random 20-character password carries about 129 bits of entropy, past the 128-bit mark considered permanently beyond brute force. Reserve the label “overkill” for passwords you must type by hand daily.

At roughly 129 bits of entropy, brute force is not meaningfully measurable — an offline attacker at 10 billion guesses per second would need longer than the age of the universe by an enormous factor. Realistic attacks against an account with a password like this target the service or the user, never the password itself.

Use a random 20-character password for anything stored in a password manager, and a passphrase for the few secrets you must remember and type — device logins and your manager’s master password. A six-word passphrase (~78 bits) is weaker on paper than 20 random characters (~129 bits) but both are beyond practical attack; memorability decides.

Primary email, banking and brokerage accounts, cloud storage, your domain registrar, and any account that can reset other accounts. Twenty characters is also a good default for Wi-Fi keys — WPA2/WPA3 accepts up to 63 characters — and for shared credentials that live in a team vault.

The vast majority do — most modern services allow at least 64 characters. A few legacy systems cap length lower or silently truncate; if a login misbehaves after you set a long password, log out and back in to check, and shorten only as far as the system forces you to.

Four extra random characters add about 26 bits, multiplying the keyspace by roughly 60 million. Both lengths are already beyond brute force, so the practical difference is margin: 20 characters keeps you far clear of the threshold even as guessing hardware improves.