This preset draws 16 characters from 31 options, lowercase letters and digits without 0, o, 1, l and i, and splits them into groups of four with hyphens, like 35ea-ggf7-cusx-u7g3. The strength is 16 × log2(31) ≈ 79.3 bits, about the same as a six-word passphrase. The hyphens sit in fixed places, so they add nothing to the strength but make the password much easier to type and proofread.
Built for typing, not for memory
Some passwords are neither remembered nor autofilled. You read them off a screen or a sheet of paper and type them into a phone, a smart TV app, a new laptop before its password manager is set up, or a colleague's device. In those moments, the hard part is not the length; it is the Shift key, the symbol page, and characters that look alike.
This preset removes all three problems. Everything is lowercase, so you never toggle case. There are no symbols except the hyphens that separate the groups, so on typical phone keyboards you only switch between the letter and number pages. And the characters most often confused in print and on screens, 0 with o and 1 with l and i, are gone.
Groups of four do for passwords what spaces do for card numbers. You can type one group, look back, check it, and move on. Mistakes are easier to spot, and you never lose your place halfway through a 16-character string.
The rule
- Characters: lowercase a–z without i, l and o (23 letters) plus the digits 2–9 (8 digits):
abcdefghjkmnpqrstuvwxyz23456789, 31 in total. - Length: 16 characters, not counting hyphens.
- Format: four groups of four, joined by hyphens, so the full password is 19 characters including the separators.
- No forced mix: each of the 16 positions is drawn independently from the 31 characters, so the entropy is exactly 16 × log2(31) ≈ 79.3 bits, about 4.95 bits per character.
Generate an easy-to-type password
- Press Generate.
- Read the four groups and make sure you can tell every character apart in the font you are using.
- Type the password group by group, including the hyphens, checking each group as you go.
- Save it in your password manager so you never need to retype it from scratch.
- If a site refuses hyphens, enter the 16 characters without them and save that exact version instead.
How strong is 79.3 bits?
Strength comes from the 16 random characters only. Averages below assume an offline attacker who holds a stolen hash and knows this exact format, at three assumed guess rates. The slowest stands for bcrypt-protected storage attacked with one modern graphics card; the middle one is that card on an unsalted SHA-256 hash; the fastest is a handful of cards on MD5 or NTLM.
| Attack scenario | Guesses per second | Average time to find it |
|---|---|---|
| Slow salted hash, one GPU | 10⁴ | 1.2 × 10¹² years |
| Fast hash, one GPU | 10¹⁰ | 1 million years |
| Fast hash, GPU rig | 10¹² | 12 thousand years |
For comparison, the default passphrase of six EFF words gives 77.5 bits, and a 16-character password with uppercase and symbols gives 99.7. This preset sits in between, far closer to the long-passphrase end than to a short password, while being the quickest of the three to type on a phone.
What the format does to site rules
- Lowercase: always present.
- Digit: present in about 99% of results, since 8 of the 31 characters are digits. If a result happens to have none and the site needs one, generate again.
- Symbol: the hyphens count as special characters on common lists, including Windows', Microsoft Entra ID's and AWS IAM's.
- Uppercase: never present. A site that insists on a capital letter will reject this format; use the no-symbols preset or the memorable preset there.
- Length: 19 characters with hyphens, 16 without, which clears NIST's 15-character single-factor minimum either way.
Where this preset fits
- Passwords typed on phones and tablets, especially for apps that block pasting.
- Temporary or initial passwords printed or shown on screen for someone else to type.
- Logins on smart TVs, streaming boxes and consoles that have a full on-screen keyboard but no password manager.
- Recovery or setup passwords you keep on paper in a safe place.
Where to choose differently
- Wi-Fi shared with guests. The Wi-Fi preset uses mixed case for more bits per character and defaults to 20 characters.
- Passwords you must remember. Groups of random characters are easy to type but hard to memorize; a passphrase works better.
- Sites that require uppercase. See the alternatives above.
Stays in your browser
The password is created locally by the page and never leaves your device. Nothing is uploaded, kept in storage or remembered between visits.
How it is generated
Each character comes from crypto.getRandomValues, mapped onto the 31-character set with rejection sampling so that no character is favored; the hyphens are inserted afterwards at fixed positions. Instructions for watching the page's network traffic are on the methodology page.
FAQ
Do the hyphens make the password stronger?
No. They are always in the same places, so an attacker gains nothing by guessing them. They make the password easier to type and check.
Can I type it without the hyphens?
Yes, as long as you always use the same version. The 16 characters carry all of the strength, so dropping the hyphens costs nothing, but the site will only accept whichever form you set.
Why are i, l, o, 0 and 1 removed?
They are the characters most often misread: i, l and 1 look alike in many fonts, and so do o and 0. Removing all five costs about 0.2 bits per character compared with using all 36 lowercase letters and digits.
Why only lowercase?
Switching case is the slowest part of typing a password on a phone or with a remote. Using one case removes that step; the length makes up for the smaller set.
Can I use this format for Wi-Fi?
Yes. WPA2 accepts 8 to 63 characters, and the 19-character result fits. Against a captured handshake, one RTX 4090 tests about 2.5 million guesses per second, so searching half of this format's possibilities would take around 5 billion years; even a thousand such cards would need millions of years. The Wi-Fi preset is still the better fit if guests type it with mixed case available.
Is 79 bits enough?
For accounts with login limits or a second factor, comfortably. For something attackable offline it is still well beyond current hardware, though a longer password costs nothing if a manager stores it.
Sources
- Windows complexity policy: special character list
- Microsoft Entra ID: allowed password characters
- AWS IAM: password policy character types
- NIST SP 800-63B-4, minimum lengths
- hashcat benchmark gist, RTX 4090
Checked 2026-10-11.
Last updated: