For systems that refuse symbols
Some banks, legacy apps, routers and command-line tools reject or mangle special characters. A password of only uppercase letters, lowercase letters and digits avoids those problems, and with 62 possible characters it loses surprisingly little strength.
16 alphanumeric characters give about 95 bits of entropy, compared with 103 bits when symbols are included. Add two characters to make up the difference.
Also handy for
- Passwords you need to paste into shell commands or URLs without escaping.
- Database and service passwords that live in connection strings.
- Devices with on-screen keyboards where symbols are buried in menus.
Frequently asked questions
Are passwords without symbols weaker?
Slightly, per character. Length matters much more: a 20-character password of letters and digits is stronger than a 16-character one with symbols.
Can I allow just a few safe symbols?
Yes. Open the options, turn on Symbols and edit the symbol set to something like -_. so only those characters are used.