Password Generator Without Symbols
Generate random passwords from letters and numbers only, with no symbols or punctuation to trip up picky forms and awkward keyboards. Everything runs in your browser through the Web Crypto API, nothing you generate ever leaves your device, and the 18 character default carries about 107 bits of entropy.
When skipping symbols is the right call
Skip symbols when the password has to be entered somewhere awkward, or when the system on the other end refuses them outright. Login forms that reject special characters, on-screen keyboards driven by a TV remote or game controller, car displays, phone keypads, and any code you have to read out loud over the phone all qualify.
The rejection case is the most common. Older enterprise logins, certain airline and utility portals, and a fair number of government sites either refuse specific symbols or, worse, silently strip them, so the password you saved is not the password the server stored. Letters and digits pass through everything.
Then there is the ten-foot keyboard problem. On a smart TV, a PlayStation, or an Xbox, you pick characters one at a time with a directional pad, and symbols usually hide on a second or third keyboard layer. Car infotainment screens and hotel set-top boxes work the same way. Every symbol means extra mode switches and extra chances to mistype. Phone support is worse still. Reading an ampersand or a caret to another person invites transcription errors, while a string of plain letters and digits can be read out in one pass.
Router passwords are the classic case, since every houseguest eventually types them into a phone or TV. Our Wi-Fi password generator handles the specific WPA2 and WPA3 rules for that job. And when nothing awkward is involved and a password manager does the typing, use the strong password generator on the homepage instead, symbols and all.
What leaving out symbols really costs
About half a bit of entropy per character, which two or three extra characters repay in full. Removing the 24 symbols shrinks the character pool from 86 to 62, so each position carries roughly 5.95 bits instead of 6.43. An 18 character password from the smaller pool beats a 16 character password that uses everything.
Here is the comparison that matters. A 16 character password drawn from the full set of letters, digits, and symbols has about 103 bits of entropy, which works out to about 14 trillion years against an offline attacker making 10 billion guesses per second. Stretch a letters-and-digits password to 18 characters and you get about 107 bits, roughly 20 times as many guesses. The password without symbols wins.
| Password | Entropy | Average time to crack |
|---|---|---|
| 16 characters, letters + digits + symbols | 103 bits | About 14 trillion years |
| 16 characters, letters + digits | 95 bits | About 76 billion years |
| 18 characters, letters + digits | 107 bits | More than 200 trillion years |
| 20 characters, letters + digits | 119 bits | Effectively uncrackable |
The model behind these numbers is deliberately paranoid: someone has stolen the password hashes and is throwing dedicated cracking hardware at them, and we count the average outcome of searching half the keyspace. A real login form with rate limiting slows an attacker down by a factor of millions. The full math lives in our guide to how long a password should be.
Keeping a typed password readable
A password without symbols is usually a password a person will read and type, and even letters and digits contain a few troublemakers. In most fonts a capital O and a zero are practically identical, and l, 1, and I can render as three copies of the same vertical stroke. That rarely matters for a password your manager autofills, but it matters a lot for a code printed on a card for a house sitter or read over the phone to a technician.
You have two easy outs. The first is to simply generate again until you get a string with nothing confusable in it; at 18 characters, every result is equally strong, so there is no cost to being picky. The second is the Easy preset on the strong password generator, which sticks to lowercase and leaves the confusable characters out entirely. Its pool is smaller, so stretch the length to the mid twenties to compensate, and check the result against the password strength checker on the homepage.
For everything else, this page keeps the full 62 character pool and all 107 bits of the 18 character standard. If a system explicitly asks for letters and numbers, the alphanumeric password generator frames the same setup for that requirement.
If a site insists on a symbol
Some sites reject any password that lacks a special character. That rule is a leftover. NIST SP 800-63B now tells sites explicitly not to force composition rules, because they barely add strength and steer people toward predictable patterns. When a form demands a symbol anyway, do not fight it. Generate a different password.
Composition rules date from an era when passwords were short and humans invented them. Forcing a symbol into an eight character human-chosen password helped a little, but it mostly produced patterns every cracking tool now tries first: a capital letter up front, an exclamation mark at the end, an @ standing in for the letter a. For randomly generated passwords the rule adds nothing that length does not already provide, which is why NIST recommends at least 15 characters instead.
So when a signup form throws a "must contain a special character" error, the practical move takes ten seconds. Open the strong password generator, set it to Hard mode, and generate at 16 characters or more. You satisfy the checkbox and walk away with a stronger password at the same time. For a closer look at which password rules genuinely help and which are theater, read what makes a strong password.
Questions? Say less.
Are passwords without symbols secure?
Yes, as long as they are random and long enough. A random 16 character password of letters and digits carries about 95 bits of entropy and would take roughly 76 billion years to crack at 10 billion guesses per second. Symbols add only about half a bit per character, a gap that two extra characters of length more than closes.
How long should a password without symbols be?
Use 18 characters, which is what this page defaults to. With the full 62 character pool that gives about 107 bits of entropy, more than a 16 character password that includes symbols. NIST recommends at least 15 characters for accounts protected by a password alone, and CISA suggests 16 or more, so 18 leaves a comfortable margin.
Why do some sites still require a symbol?
Old policy, mostly. Composition rules spread in the 1990s and got baked into compliance checklists, and plenty of sites never revisited them. Current NIST guidance in SP 800-63B tells verifiers not to impose composition rules at all, because forced symbols push people toward predictable habits like ending every password with an exclamation mark. Sites are simply slow to catch up.
What if a password comes out hard to read?
Characters like capital O and the digit 0, or lowercase l and the digit 1, look nearly identical in many fonts. Generate again until it reads cleanly; every result is equally strong. For codes that will live on paper, the Easy preset on our strong password generator sticks to lowercase and drops the confusable characters entirely.
Is this the same as an alphanumeric password generator?
Nearly. Both draw from the same 62 characters: lowercase letters, uppercase letters, and digits. The difference is the framing and the starting point. This page begins at 18 characters because no-symbol passwords usually get typed by hand somewhere awkward. The alphanumeric page starts at 16 and speaks to systems that demand letters and numbers.
Does this generator send my password anywhere?
No. Generation happens entirely on your device using crypto.getRandomValues, the cryptographic random source built into every modern browser, with rejection sampling so no character is favored. Open DevTools while you generate and you will see zero network requests. Once the page has loaded, it even keeps working with your internet connection turned off.