[signal11]

NIST's 2017 guidelines say:

5.1.1.2: "Verifiers SHALL require subscriber-chosen memorized secrets to be at least 8 characters in length. Verifiers SHOULD permit subscriber-chosen memorized secrets at least 64 characters in length." [1]

[1] https://pages.nist.gov/800-63-3/sp800-63b.html or https://doi.org/10.6028/NIST.SP.800-63b

[meteor333]

Thank you. That helps.

[rabboRubble]

I use a common password manager and its max generated password length is 64, so it's in agreement with NIST. That said I am able to manually add characters to increase beyond 64.