In password security, the longer the better. With a password manager, using more than 24 characters is simple. Unless, of course, the secure password is not accepted due to its length. (In this case, through STOVE.)
Possibly indicating cleartext storage of a limited field (which is an absolute no-go), or suboptimal or lacking security practices.
For a system I worked on a few years ago I got the password requirement:
Only upper case letters A-Z, no letter or symbols.
Exactly 7 characters.
I was also recommended to make it a single word to make it memorable.
PASSWOR