Password without special characters
Letters and digits only — for systems that reject punctuation and for passwords you will have to dictate or type with a remote control.
Space — new password · C — copy · M — hide
Password length
Character sets
Select at least one character set.
Passphrase settings
A 2048-word list gives exactly 11 bits per word (the Diceware method). Six words are 66 bits, eight are 88. The words are drawn by a cryptographic generator, not by a human — that is the whole point.
Password pattern
a — lowercase, A — uppercase, L — any letter, 9 — digit, # — symbol, X — letter or digit, * — any enabled character, c/v — consonant/vowel. Every other character is copied as is, \ escapes the next one.
Fine tuning
“Safe symbols only” keeps !@#$%^&*_-+=? — almost every site accepts them and they do not break shell commands, CSV or SQL.
Recent passwords (this tab only)
What happens to your password
The password is assembled in your browser from the cryptographic randomness source crypto.getRandomValues with rejection sampling, so every character is equally likely.
The page never sends passwords to a server, never writes them to browser storage and drops the history when the tab closes.
Password letter by letter
Phonetic spelling for reading a password out over the phone. Letter case is stated separately.
Why sites ban symbols
The reason is almost always old code. Quotes, backslashes and semicolons once broke database queries, and instead of handling them properly developers banned the input.
The worst variant is when there is no ban and the password is silently truncated at the first awkward character. You sign up with sixteen characters, the system stores eight, and login works because it truncates your input too. Then you change device and cannot get in.
For banks, government portals and any legacy system it is safer to take a longer password without symbols from the start.
What compensates
The alphabet shrinks from 94 characters to 62: from 6.55 to 5.95 bits per character. That is a ten per cent loss, closed by two or three extra characters.
Twenty letters and digits give 119 bits — more than sixteen characters from the full set. The restriction is not a problem unless you insist on the same length.
A side benefit: such a password can be dictated over the phone and typed with a TV remote. For a Wi-Fi key that argument decides it.
Questions
Frequently asked questions
Why do some sites reject symbols?
Usually a trace of old code: quotes, backslashes and semicolons once broke database queries, and instead of handling them properly developers simply banned them. Sometimes the password is silently truncated at the first awkward character and login stops working with no explanation.
How much does this weaken the password?
The alphabet shrinks from 94 characters to 62, from 6.55 to 5.95 bits per character. That is a ten per cent loss, fully offset by two or three extra characters of length.
Where else is this useful?
Wi-Fi keys typed with a TV remote, codes dictated over the phone, and data for systems where the password ends up on a command line or in a CSV export.
Next