There's realistically no reason not to generate the max password. The different in possibilities between a password with 16 characters and one with 20 (using a-zA-Z0-9!@#$%^&*()?-+." which isn't even all the options) is 1.2E30 v s 4.13E37. That's seven orders of magnitude from 4 characters. The difference between $1 and $10,000,000. But to be fair, 1.2E30 possible combinations is kind of a lot already, but why not add a few more characters just for the hell of it?