Skip to content
Constraint preset

Password generator with special characters

Forms that demand one of each character class will reject an otherwise excellent password on a technicality. This generator guarantees at least one uppercase letter, one lowercase letter, one digit, and one symbol, so the form accepts it first time.

Very strong102.8 bits of entropy

Offline attack on a fast hash: 1 trillion years

Beyond the reach of brute force. Your risk is now phishing and reuse, not guessing.

16
Include

Generated in your browser with crypto.getRandomValues. Nothing is sent to a server, logged, or stored.

Entropy
102.8 bits
Character pool
86 symbols
Equivalent full-set length
16 chars
GPU, fast hash
1 trillion years

When you need this

Any signup form showing a checklist of red crosses next to 'must contain a special character'. The guarantee is built into the generator rather than left to chance.

What the restriction costs you

Guaranteeing one of each class very slightly reduces randomness compared with drawing purely uniformly, because some combinations are excluded. The effect is a fraction of a bit and is worth it to get past the form.

In concrete terms: this page generates 16 characters from a pool of 86, which is 102.8 bits — the same strength as a 16-character password using the full 86-symbol set. The constraint is not the problem people assume it is, as long as you compensate with length.

Why sites reject passwords without telling you

A rejected password is almost never about strength. The usual culprits, roughly in order of how often they bite:

  • An undisclosed maximum length. Plenty of systems silently cap at 16 or 20 characters, and some truncate rather than reject — so the password is accepted at signup and then fails at login.
  • A symbol the backend cannot handle. Quotes, backslashes, angle brackets, and semicolons break naive input handling, so they get banned wholesale.
  • Leading or trailing spaces that get trimmed on one screen and not the other.
  • A similarity rule forbidding your name, email, or a previous password — usually unstated.
  • A paste block on the confirmation field, which turns a correct password into a typo.

If a password fails and you cannot tell why, try this generator's output first, then shorten it. Those two moves resolve the large majority of cases.

How long this password survives each attack

"Time to crack" is meaningless without naming the attack. The same password fails in an afternoon or outlives the sun depending on how the website stored it. These are average times — half the keyspace — for this password:

Estimated average crack time by attack scenario for this password configuration
Attack scenarioGuesses / secondAverage time
Throttled login form10010^21 years
Stolen database, unsalted fast hash100 billion1 trillion years
Stolen database, PBKDF2 with 600,000 iterations~167,00010^17 years

The third row is why key stretching matters so much. MoolKey runs PBKDF2 at 600,000 iterations for the same reason: it costs you a fraction of a second and costs an attacker a factor of 600,000.

You still have to keep it somewhere

A 16-character random string is not memorable, and pretending otherwise is how people end up with a sticky note. Either store it in a password manager, or use a generator that can recreate it on demand from one phrase you already remember — which means there is no stored copy for anyone to steal.

Common questions

Why would a site reject my password?
Almost always because of an undocumented rule: a maximum length you were not told about, a symbol the system cannot store, a space that gets trimmed, or a requirement that the password not contain your name or email. Sites rarely explain which rule you broke, which is why a generator you can constrain is useful.
Is a password without symbols still secure?
Yes, if you add length. Dropping symbols takes the pool from 86 characters to 86, costing about 0.00 bits per character. Two or three extra characters more than covers the difference, and this page already accounts for that.
How strong is this 16-character password?
It carries 102.8 bits of entropy from a 86-character pool — equivalent to a 16-character password using the full symbol set. Against an offline attack on a fast hash at 100 billion guesses per second, the average time to crack it is 1 trillion years.
Is this generator safe to use?
Yes. It runs entirely in your browser using crypto.getRandomValues, the cryptographic random source provided by your operating system. Nothing is transmitted, logged, or stored, and it keeps working with the network disconnected.

More free tools

Every tool runs in your browser without an account. The generators, strength checker, and entropy calculator keep inputs local. The breach checker sends only a five-character hash prefix to Have I Been Pwned.

Make one account easier today.

Start with the password you keep reusing or the bank card that still shares a PIN. MoolKey is free, and you do not need to move everything at once.

Open MoolKey freeRead how it works
Free forever Works offline Phone or computer