Yes, but only slightly. Does excluding ambiguous characters weaken a password? For two passwords of equal length picked uniformly at random, a smaller character pool means fewer possible combinations, so calculated entropy drops a little. A long, genuinely random password stays strong, and one extra character usually more than makes up the difference.
Below I walk through the math with a clearly labeled example, explain when the formula stops being exact, and show how to set the exclusions in your generator. Figures are current as of November 1, 2026.
Table of Contents
What counts as an ambiguous character?
An ambiguous character is one that looks like another character in many fonts. The usual set is the digit zero (0), capital O, the digit one (1), lowercase l and capital I. They cause trouble when you read a password from a screen or a printed sheet and type it somewhere else.
Excluding them is a generator setting. The generator simply never picks those characters. Start with the 62 letters and digits (26 uppercase, 26 lowercase and 10 digits). Remove those five and 57 characters remain for every position.
Two terms help here. Entropy is a measure, in bits, of how many equally likely options a password could have been picked from. A character pool is the set of characters the generator is allowed to choose from.
The same idea applies to usernames. The Username Generator has an Avoid Ambiguous Characters filter, which helps when you want a name that is easy to read aloud or copy by hand.
Does excluding ambiguous characters weaken a password in numbers?
For a password where every character is picked uniformly and independently, the calculation is H = L × log₂(P). H is entropy in bits, L is the length and P is the pool size. The figures below are calculations under those assumptions, not measured cracking times and not guarantees against account compromise.
| Setup | Length | Pool size | Approximate entropy |
|---|---|---|---|
| Letters and digits | 16 | 62 | 95.27 bits |
| Five lookalikes removed | 16 | 57 | 93.33 bits |
| Five lookalikes removed | 17 | 57 | 99.16 bits |
At 16 characters, excluding the five lookalikes costs about 1.94 bits. That is a real but small reduction. It does not turn a random password into a weak one, and I would not treat these bits as a universal strength threshold.
Can one extra character make up for the loss?
Yes. The 17-character password from the 57-character pool reaches about 99.16 bits. That is higher than the 95.27 bits of the 16-character password from the full 62-character pool. Each added character contributes roughly 5.8 bits here, which is more than the 1.94-bit loss.
This fits current official guidance. NIST finalized SP 800-63 Revision 4 in July 2025, and its SP 800-63B-4 guidance identifies length as a primary factor in password strength. For services that check passwords, NIST sets a 15-character minimum for single-factor passwords, allows an eight-character minimum when the password is only part of multifactor authentication, and says verifiers must not impose other composition rules.
Those are rules for websites and apps, not advice about generator settings. Avoiding lookalikes is not a NIST requirement. It is a usability choice you make for yourself.
A simple habit: if you exclude lookalikes, set the length one or two characters higher than you otherwise would. The Secure Password Generator lets you choose the length and character types, and it uses cryptographically secure random number generation in your browser.
Does excluding ambiguous characters weaken a password when the rules are not uniform?
This section is for IT and web development beginners, but everyday readers can use the takeaway at the end.
The pool-size formula describes a generator only when each allowed character is equally likely at every position. Several common settings break that assumption:
- A template that requires at least one digit or symbol.
- A fixed prefix or suffix added to every password.
- A rule that prevents repeated characters.
- Swapping confusing characters after the password is generated.
The last one matters most. Excluding characters before random selection changes the pool, and every remaining character stays equally likely. Replacing a confusing character afterward is a fixed substitution, which can make some outputs more likely than others. In all of these cases, L × log₂(P) is a rough guide, not an exact description.
NIST also says in its password-strength guidance that estimating entropy for user-chosen passwords is challenging. The simple pool calculation fits best when the selection process is genuinely random and known. So do not apply it to a password you invented yourself. For a related puzzle, see the article on why a high entropy figure can still get a weak strength score.
Takeaway: let the generator exclude characters before it picks, and do not edit the result by hand.
How do you set exclusions and check the numbers?
Here is a practical way to use the generator and the calculator together.
- Open the Bulk Password Generator and choose a length. It can create up to 100 passwords at once, and it runs in your browser.
- Turn on the character types you want, such as uppercase, lowercase, numbers and symbols.
- Type the lookalikes (0, O, 1, l and I) into the Exclude Characters field.
- Keep a large eligible pool. Do not exclude so many characters that very little remains.
- Generate fresh passwords with those settings instead of editing one afterward.
The Password Entropy Calculator shows length, pool size and an estimate calculated as length × log₂(pool size). There is one limitation to know. It infers the pool from the character classes that appear in the password you submit (26 lowercase, 26 uppercase, 10 digits, plus the unique symbols it sees). It does not take your exclusion list as an input.
That means it would count a password made from a 57-character pool as if it came from 62. For a true before-and-after comparison, use the formula yourself with the real pool sizes, as in the table above. Its estimated time to crack also rests on a fixed guess-rate assumption, so treat it as a teaching figure and not a prediction.
The calculator page says input is never stored or sent, but I still suggest testing a sample value rather than a password you plan to use.
What matters more than a few lost bits?
CISA advises long, random and unique passwords, with a different one for every account. Its password tip sheet is dated September 2024. NIST adds that phishing and keylogging are not stopped by password length or complexity, so a difference of under two bits should never be mistaken for a full security review.
- Use one unique password per account. Reuse is what makes breaches spread.
- Turn on two-factor authentication or passkeys. A passkey is a sign-in credential stored on your device that replaces the typed password with a cryptographic key.
- Check for exposure. The Password Leak Checker uses k-anonymity, a method that sends only a small fragment of a hash so the service cannot tell which password you checked. It queries the Have I Been Pwned database.
- Store passwords in a reputable password manager. If one fills them in for you, you rarely need to read or type them, so you may not need to exclude lookalikes at all.
- Change a password when there is a reason, such as a breach or suspected compromise, not on a fixed schedule.
For a printable list of actions, the Password Safety Checklist covers the habits worth setting up this week.
Frequently asked questions
Does excluding lookalike characters make a password easier to crack?
It slightly reduces the number of possible combinations. At 16 characters, removing 0, O, 1, l and I lowers the calculated entropy from about 95.27 to 93.33 bits. That is a calculation, not a cracking time, and one extra character more than offsets it.
Which characters should I exclude?
The common set is 0, O, 1, lowercase l and capital I. The best list depends on the font you read them in. Keep the eligible pool large, so only exclude characters that actually cause confusion for you.
Is it better to swap lookalikes after the password is generated?
No. A fixed substitution after generation can make some outputs more likely than others. Excluding characters before random selection keeps every remaining character equally likely.
Does the Password Entropy Calculator know which characters I excluded?
No. It infers the pool from the character classes that appear in the password you submit, so it cannot see your exclusion list. For an exact comparison, calculate length × log₂(pool size) yourself using the real pool size.
Is a 16-character password from a 57-character pool strong enough?
A genuinely random 16-character password is longer than NIST’s 15-character minimum for services that accept single-factor passwords. Real protection also depends on how a service stores passwords and limits guesses, so I do not offer one universal threshold. Keep it unique to one account.
Do I need to exclude lookalikes if a password manager fills in my passwords?
Usually not. If you rarely read or type the password, the full pool gives you the most combinations per character. Exclusions help most for passwords you must read aloud or type by hand.
What if I also exclude symbols from the generator?
The pool shrinks further, so each character adds fewer bits. The fix is the same: use a longer length. Always generate your own value with a tool instead of reusing a sample.
Next steps
So, does excluding ambiguous characters weaken a password? In calculation, slightly. In practice, not meaningfully when the password is long, picked randomly and used on one account only. Here is the short recap:
- Exclude lookalikes in the generator before the password is created, never by editing it afterward.
- Add a character or two to make up for the smaller pool.
- Use the real pool sizes when you calculate entropy yourself.
- Keep one unique password per account.
- Add two-factor authentication or passkeys and check for breaches.
Related tools and resources on Password Ideas:
