Password Generator · Practical guide
Password Generator Without Ambiguous Characters
Skip look-alike characters like 1, l, I, o, 0, and O — ideal for passwords you have to read or type by hand.
At a glance
What Are Ambiguous Characters?
Ambiguous characters are the ones that look nearly identical in many fonts: i, l, 1, L, I, o, 0, and O. When you generate a password without ambiguous characters, these eight are removed from the pool, so you will never squint at a password wondering whether that character is a one, a lowercase L, or a capital i.
Interactive tool
Password Generator
Enter your own values, then compare the result with the examples below.
Generated Password
When to Exclude Them
- Wi-Fi passwords you have to type on a TV, game console, or smart thermostat.
- Passwords you read aloud to someone over the phone.
- Passwords printed or written down temporarily during a device setup.
- Any time you will transcribe the password by hand instead of pasting it.
How Much Strength Do You Lose?
Very little. Removing the eight look-alike characters shrinks the full pool from 94 to 86 characters, which costs only about 2 bits of entropy on a 16-character password:
| Length | Full Pool (94 chars) | No Ambiguous (86 chars) |
|---|---|---|
| 12 characters | 78.7 bits | 77.1 bits |
| 16 characters | 104.9 bits | 102.8 bits |
| 20 characters | 131.1 bits | 128.5 bits |
Even at 102.8 bits, a 16-character password without ambiguous characters would take trillions of years to brute-force offline. The tiny strength cost is well worth it if it prevents a single mistyped character — just add one extra character of length and you come out ahead.
Frequently Asked Questions
Which characters does the generator remove?
It removes i, l, 1, I, L, o, 0, and O from whichever character sets you have selected — three uppercase, three lowercase, and two digits.
Does excluding ambiguous characters make my password weak?
No. You lose about 0.13 bits of entropy per character. A 16-character password still has about 103 bits of entropy, far beyond brute-force reach.
Should I always exclude ambiguous characters?
Only if you will read or type the password manually. If a password manager pastes it for you, keep the full character pool for maximum entropy.
Are the generated passwords stored anywhere?
No. Everything runs locally in your browser — the password is generated on your device and never sent anywhere.