22-Character Password Generator

It is the shortest length that clears 128 bits of entropy even without symbols: 22 random letters and digits carry about 131 bits, while 21 fall just short at about 125. With the full character set, 22 characters reach about 142 bits. One length, safe under either setting.

At about 142 bits, an offline attacker testing 10 billion guesses per second would need around 8.8 × 10²⁴ years on average — hundreds of trillions of times the age of the universe. Brute force is not a meaningful threat; attacks go after the service, the transport, or the user instead.

It means guessing the password is as hard as brute-forcing an AES-128 key: 2¹²⁸ possibilities, a number no amount of hardware can work through. A random password crosses that line at 20 characters with symbols, or at 22 with letters and numbers only.

Yes. Machine secrets are pasted, never typed, so length costs nothing — and they often end up in places where symbols cause escaping trouble. Switch symbols off and 22 characters still clears 128 bits, which is why it makes a good fixed default for generated secrets.

With symbols, both clear 128 bits (about 129 versus 142). The difference shows up when symbols are off: 20 alphanumeric characters give about 119 bits, 22 give about 131. If you might ever need the letters-and-numbers option, 22 is the safer default.

Almost all will — most modern services allow at least 64 characters, and NIST SP 800-63B tells systems to permit at least 64. If a login fails after you set one, the system may be truncating it: log out and back in to check, and shorten only as far as the system forces you to.