Generate a Database Password

Database Password Security

Database passwords protect direct access to your data. Unlike user-facing accounts, database credentials are typically stored in configuration files, environment variables, or secrets managers — so memorability is not a concern. Maximum entropy is the priority.

Database-Specific Character Restrictions

Different database systems have different password limitations:

MySQL

• Maximum 32 characters (older versions), unlimited in MySQL 8.0+
• Avoid ' (single quote) — causes issues in SQL statements
• Avoid \ (backslash) — escape character in MySQL

PostgreSQL

• Supports passwords up to 99 characters (md5) or 1000 characters (scram-sha-256)
• Avoid ' in passwords used in pg_hba.conf
• Use scram-sha-256 authentication (not md5)

MongoDB

• No strict character limit
• Avoid @, :, / — these are URI delimiters in MongoDB connection strings
• Or use percent-encoding: @ becomes %40

Redis

• The requirepass directive supports any string
• Avoid # — comment character in config files
• In Redis 6+, use ACLs instead of a single password

Connection String Escaping

Database passwords appear in connection strings where special characters need escaping:

# PostgreSQL connection string
postgresql://user:p%40ssw%23rd@host:5432/db

# MongoDB connection string
mongodb://user:p%40ssw%23rd@host:27017/db

Characters that need URL-encoding in connection strings: @, :, /, ?, #, %, [, ].

Recommended Database Password Configuration

Length:     32-64 characters
Characters: Alphanumeric + safe symbols (- _ . ~)
Avoid:      ' " \ @ : / ? # % [ ]
Storage:    Environment variable or secrets manager

Example Database Passwords

xK7m9pR2nT4vB8qW3hL6jY1cF5gD0sA
Nt3vR8kL2pY6wH9mQ4bJ7xF1cG5dA0e

Storage Best Practices

• Never hard-code database passwords in source code
• Use environment variables (.env files excluded from version control)
• Use a secrets manager (AWS Secrets Manager, HashiCorp Vault, Doppler)
• Rotate database passwords regularly using automated tooling
• Use separate credentials per application and environment