

In my opinion, an acceptable password length should be L
in ln(alphabetSize^L)/ln(2) = (B bits of entropy)
. For a Bech32 character set (since it excludes ambiguous characters), alphabetSize = 32
. A good password should have been 96 and 256 bits of entropy, with 128 bits being my personal preference. This means L = (B)*ln(2)/ln(alphabetSize) = 128*ln(2)/ln(32) = 25.6 = 26 characters
.
That’s… pretty close to what OP said they were restricted to, so maybe the person who set the 24 character restriction used a similar methodology.
Either Butlerian Jihad or Yokohama Kaidashi Kikou.