When length is free
Machines do not mind long passwords. Service accounts, database users for applications, SMTP credentials and other secrets that live in configuration files can use 64 random characters at no cost, giving over 400 bits of entropy.
For people, 64 characters only makes sense when a password manager fills it in. Check that the system accepts this length first: some cap passwords at 64 characters or fewer, and bcrypt only uses the first 72 bytes, so 64 stays safely under that limit.
Watch out for special characters in config files
Symbols like $, # and quotes can break shell scripts, .env files and connection strings. If the secret will live in a config file, turn off symbols or edit the symbol set down to characters like – and _. Letters and digits alone still give about 380 bits.
Frequently asked questions
Is a 64-character password better than 32?
Both are far beyond brute force. The extra length is a free safety margin for secrets that machines handle, not a practical necessity.
Why does my app reject the password?
Usually because of a length limit or a character it does not allow. Try a shorter length or turn off symbols.