This preset draws 16 characters from the 62 letters and digits, giving 16 × log2(62) ≈ 95.3 bits. Leaving out the 14 symbols costs only about 0.29 bits per character, 4.7 bits at this length, and adding a single character (17 letters and digits, 101.2 bits) more than makes up for it. Symbols help far less than people think; length does the work.
When symbols cause more trouble than they are worth
Password advice has long said "use special characters", and many sign-up forms still insist on one. Yet plenty of systems handle them badly, and some forbid them outright:
- Sites with their own symbol lists. Services often accept only a specific set of "special characters". AWS IAM's password policy, for example, defines non-alphanumeric characters as
! @ # $ % ^ & * ( ) _ + - = [ ] { } | '. This site's generator also uses?and~, which are not on that list, so a symbol requirement on such a service might not count them. Other services publish narrower lists, or none at all. - Databases and command lines. Oracle Database requires passwords containing characters other than letters, digits and the special characters
_,$and#(for example@) to be wrapped in double quotes in SQL, and the same goes for any password that starts with a digit or special character. Shells and connection strings have their own rules for$,&,!and#. - Phones, TVs and consoles. Symbols sit on a separate keyboard page, and some on-screen keyboards hide the less common ones.
- Reading a password aloud. "Caret, tilde, at sign" over the phone invites mistakes in a way "capital K, seven, lowercase m" does not.
- Older systems. Some legacy systems accept only a handful of symbols. IBM i at its lower password levels allows just
$,@,#and_, plus uppercase letters and digits.
In all of these cases, letters and digits pass without friction. The question is how much strength you give up.
What leaving symbols out costs
Each character from the full 76-character set adds log2(76) ≈ 6.25 bits; from the 62 letters and digits, log2(62) ≈ 5.95 bits. The difference is about 0.29 bits per character. Here is what that means at common lengths, with guessing times for the letters-and-digits version under two assumed offline attack rates: 10¹⁰ guesses per second (a single RTX 4090 on unsalted SHA-256 is in that range) and 10¹² (several such cards on MD5 or NTLM).
| Length | Letters and digits | With the 14 symbols added | Bits given up | Half the space at 10¹⁰/s | Half the space at 10¹²/s |
|---|---|---|---|---|---|
| 12 | 71.5 | 75.0 | 3.5 | 5,112 years | 51 years |
| 14 | 83.4 | 87.5 | 4.1 | 20 million years | 196 thousand years |
| 16 | 95.3 | 100.0 | 4.7 | 76 billion years | 755 million years |
| 17 | 101.2 | 106.2 | 5.0 | 4.7 × 10¹² years | 47 billion years |
| 20 | 119.1 | 125.0 | 5.9 | 1.1 × 10¹⁸ years | 1.1 × 10¹⁶ years |
Seventeen letters and digits beat 16 characters with symbols. One extra character, which costs nothing when a password manager types it, buys more than symbols ever did.
The rule
- Characters: the 26 uppercase letters, 26 lowercase letters and 10 digits, 62 in all. No look-alikes are removed by default, so turn on that option if you will read the password by eye.
- Length: 16 by default; you can change it.
- No forced mix. Each character is drawn independently from the 62, without a rule that every type must appear, so the strength figure is exactly length × log2(62). In a 16-character result, at least one digit appears about 94% of the time; if a site insists on a digit and the result has none, simply generate again.
Generate a password without symbols
- Keep the length at 16, or raise it by a character or two if you want to match a symbol-including password.
- Press Generate; the meter should show about 95.3 bits for 16 characters.
- Check that the result has the character types the site demands, and press Generate again if not.
- Paste it into the site and save it in your password manager.
- If the system still rejects it, check its length limit next, since symbols are no longer the cause.
Where a no-symbols password fits
- Sites and apps that reject special characters, or reject the particular ones in this generator's set.
- Database, script and configuration secrets that would otherwise need quoting or escaping.
- Accounts you sign into on a TV, console or phone keyboard.
- Passwords you may have to read to a colleague or a help desk.
Where it does not
- Sites that demand a symbol. Switch symbols back on in the password generator, or use the memorable preset, whose hyphens count as special characters on most lists.
- Very short limits. If a system caps you at 8 or 10 characters, every bit matters; use every character type it accepts. The 10-character page has an example.
- Wi-Fi networks. The Wi-Fi preset is also symbol-free but removes look-alike characters and defaults to 20 characters for offline protection.
Your password is not sent anywhere
Generation happens in your browser. The 16 characters exist only on your screen and in the page's memory until you close it; nothing is uploaded or stored.
Technical detail
The 62 characters are selected with crypto.getRandomValues. Because random values do not divide evenly into 62 buckets, the generator discards out-of-range values and redraws them, so every letter and digit has identical odds. The methodology page describes a simple developer-tools check that the page makes no requests while generating.
FAQ
Is a password without symbols weak?
No. Sixteen random letters and digits give about 95.3 bits, far beyond any guessing attack. Symbols add about 0.29 bits per character, less than a third of a bit.
How many characters make up for leaving symbols out?
One. Seventeen letters and digits carry about 101.2 bits, more than the 100 bits of 16 characters with symbols.
Why does a site say my password needs a special character?
Many sites still use composition rules, even though NIST's current guidelines tell services not to impose them. Turn symbols on, or add a hyphen or another symbol the site allows.
Why would a site reject some symbols but not others?
Each service defines its own list. Characters such as quotes, backslashes and angle brackets are commonly refused; others like ? or ~ may simply not count toward a "special character" rule.
Should I also exclude look-alike characters?
If you will ever read or type the password from paper, yes. Removing 0, O, o, 1, l and I leaves 56 characters and costs about 0.15 bits per character.
Sources
- AWS IAM: Set an account password policy
- Oracle Database 19c Security Guide: password guidelines
- IBM i 7.5: QPWDLVL
- NIST SP 800-63B-4, composition rules
- RTX 4090 hashcat 6.2.6 results
Checked 2026-10-11.
Last updated: