Password generator without special characters
Made on your device. Never sent or stored.
Letters and digits only, for sites, apps and config files that refuse symbols. Add length to keep it strong.
Strong without symbols
Dropping symbols shrinks the pool from 87 characters to 62, which costs about half a bit per character. Two or three extra characters win it all back. A 20 character password of letters and digits has about 119 bits of entropy, more than a 16 character password with symbols.
| Characters | Pool | Bits | Fast hash | Slow hash |
|---|---|---|---|---|
| Digits only | 10 | 66.4 | 158 years | 158 million years |
| Lowercase letters | 26 | 94.0 | 32 billion years | 32 quadrillion years |
| Letters, both cases | 52 | 114.0 | 33 quadrillion years | over 1022 years |
| Letters and digits | 62 | 119.1 | 1 quintillion years | over 1024 years |
| All four types (this site) | 87 | 128.9 | 978 quintillion years | over 1026 years |
Some systems reject symbols because they break scripts, connection strings, shell commands or URLs. Letters and digits pass through all of those without escaping, which is why they are a good choice for database passwords and environment variables too.
Questions
Is a password without symbols weak?
Not if it is long and random. Length matters far more than symbols. NIST SP 800-63B-4 tells sites not to require character mixtures at all.
What if the site needs one symbol?
Use the main generator with symbols on and "at least one of each type" checked. It guarantees at least one symbol.
Sources
- SP 800-63B-4, section 3.1.1.2: Password Verifiers, National Institute of Standards and Technology. Checked 18 October 2026.