Strong password without special characters

How it works

How it is done

1. Build the alphabet by joining the character classes that are switched on - 26 lower-case letters, 26 upper-case, 10 digits, and 28 ASCII punctuation marks with the two quote characters, the backtick and the backslash left out.
2. If look-alike characters are excluded, remove capital i, lower-case L, one, the pipe, zero and capital O from that alphabet before anything else happens.
3. Work out the rejection limit - the largest whole multiple of the alphabet size that is not greater than 256. For an alphabet of 90 that limit is 180.
4. Draw one byte from crypto.getRandomValues. Discard it if it is at or above the limit, because folding it in with a remainder would make the first few characters of the alphabet more likely than the rest. Otherwise take the character at that byte's remainder.
5. Repeat until the candidate is the requested length.
6. If at least one of every kind is required and the candidate is missing a kind, throw the whole candidate away and draw a fresh one. Do not repair it by substituting a character, because that produces a distribution nobody can state the entropy of.
7. Count the passwords the settings can produce, by inclusion and exclusion over the classes, and report the base-2 logarithm of that count as the entropy in bits.

What it assumes

• The entropy figure describes the generator, not the string. A run of 20 lower-case letters is exactly as strong as any other draw of the same settings, because an attacker has no way of knowing it came out that way.
• Requiring at least one of every kind reduces the number of passwords the generator can produce, so it reduces entropy. This tool reports the reduced figure; most generators report the larger one.
• The time to guess assumes 100 billion guesses a second, which is an offline attack with commodity graphics hardware against a fast, unsalted hash. A password stored with bcrypt or Argon2 is many orders of magnitude slower to attack, and a rate-limited login is slower again.
• The time shown is the average, not the worst case - half the search space, or two to the power of one less than the entropy.
• Two quote characters, the backtick and the backslash are left out of the symbol set because they break when a password is pasted into a shell command or a JSON file. That costs about 0.06 bits per character.
• Entropy says nothing about reuse, phishing or a breach at the other end. A perfect password used in two places is one password.

Method written and checked by Tessalor on Jul 30, 2026.