Password generator without special characters
Some sites reject symbols outright, or accept them and then break on the ones you chose. This generator uses letters and numbers only — a 62-character pool. That costs about 0.5 bits per character against the full set, which you make back by adding two or three characters.
- Entropy
- 119.1 bits
- Character pool
- 62 symbols
- Equivalent full-set length
- 19 chars
- GPU, fast hash
- 10^17 years
When you need this
Banking portals, airline sites, legacy enterprise logins, and point-of-sale systems frequently reject symbols, or silently mangle them so the password you set is not the one stored.
What the restriction costs you
Dropping symbols shrinks the pool from 86 characters to 62, which costs roughly 0.47 bits per character. At 20 characters you still clear 119 bits, so the restriction genuinely does not matter once you add length.
In concrete terms: this page generates 20 characters from a pool of 62, which is 119.1 bits — the same strength as a 19-character password using the full 86-symbol set. The constraint is not the problem people assume it is, as long as you compensate with length.
Why sites reject passwords without telling you
A rejected password is almost never about strength. The usual culprits, roughly in order of how often they bite:
- An undisclosed maximum length. Plenty of systems silently cap at 16 or 20 characters, and some truncate rather than reject — so the password is accepted at signup and then fails at login.
- A symbol the backend cannot handle. Quotes, backslashes, angle brackets, and semicolons break naive input handling, so they get banned wholesale.
- Leading or trailing spaces that get trimmed on one screen and not the other.
- A similarity rule forbidding your name, email, or a previous password — usually unstated.
- A paste block on the confirmation field, which turns a correct password into a typo.
If a password fails and you cannot tell why, try this generator's output first, then shorten it. Those two moves resolve the large majority of cases.
How long this password survives each attack
"Time to crack" is meaningless without naming the attack. The same password fails in an afternoon or outlives the sun depending on how the website stored it. These are average times — half the keyspace — for this password:
| Attack scenario | Guesses / second | Average time |
|---|---|---|
| Throttled login form | 100 | 10^26 years |
| Stolen database, unsalted fast hash | 100 billion | 10^17 years |
| Stolen database, PBKDF2 with 600,000 iterations | ~167,000 | 10^22 years |
The third row is why key stretching matters so much. MoolKey runs PBKDF2 at 600,000 iterations for the same reason: it costs you a fraction of a second and costs an attacker a factor of 600,000.
You still have to keep it somewhere
A 20-character random string is not memorable, and pretending otherwise is how people end up with a sticky note. Either store it in a password manager, or use a generator that can recreate it on demand from one phrase you already remember — which means there is no stored copy for anyone to steal.
Common questions
- Why would a site reject my password?
- Almost always because of an undocumented rule: a maximum length you were not told about, a symbol the system cannot store, a space that gets trimmed, or a requirement that the password not contain your name or email. Sites rarely explain which rule you broke, which is why a generator you can constrain is useful.
- Is a password without symbols still secure?
- Yes, if you add length. Dropping symbols takes the pool from 86 characters to 62, costing about 0.47 bits per character. Two or three extra characters more than covers the difference, and this page already accounts for that.
- How strong is this 20-character password?
- It carries 119.1 bits of entropy from a 62-character pool — equivalent to a 19-character password using the full symbol set. Against an offline attack on a fast hash at 100 billion guesses per second, the average time to crack it is 10^17 years.
- Is this generator safe to use?
- Yes. It runs entirely in your browser using crypto.getRandomValues, the cryptographic random source provided by your operating system. Nothing is transmitted, logged, or stored, and it keeps working with the network disconnected.
More free tools
Every tool runs in your browser without an account. The generators, strength checker, and entropy calculator keep inputs local. The breach checker sends only a five-character hash prefix to Have I Been Pwned.
Passphrase generator
A passphrase is several random words joined together, such as "trout-canyon-mellow-drift".
PIN generator
A PIN generator picks digits at random instead of letting you reach for a birthday.
Strength checker
A password strength checker estimates how many guesses an attacker needs before reaching your password.
Breach check
A breach check tells you whether a password already appears in leaked data.
Entropy calculator
Password entropy measures how many guesses an attacker needs, expressed in bits.
Make one account easier today.
Start with the password you keep reusing or the bank card that still shares a PIN. MoolKey is free, and you do not need to move everything at once.