Characters that look similar in many fonts: I (uppercase i) and l (lowercase L) and 1 (one), O (uppercase o) and 0 (zero), B and 8, S and 5, Z and 2, G and 6. When removed, passwords are much easier to read and transcribe accurately.
When you need to read a password from a printout, dictate it over the phone, or type it from a handwritten note. Also useful for temporary passwords given to guests or new employees where readability matters more than maximum entropy density.
Removing look-alike characters reduces the pool size from ~72 to ~60 characters per position, so entropy per character drops slightly. At 12 characters you still get ~70 bits of entropy. For maximum security, increase the length to 16 or use the standard generator.
What characters are excluded?
The look-alike characters I (uppercase i), l (lowercase L), 1 (one), O (uppercase o), 0 (zero), o (lowercase o), B and 8, S and 5, Z and 2, G and 6 are removed from all character sets.
Why remove look-alike characters?
It reduces transcription errors when reading a password from a printout, sharing it over the phone, or typing it from a handwritten note. The trade-off is slightly less entropy per character length.
Are these passwords still secure?
Yes. A 12-character password without look-alikes still has ~60 bits of entropy, which is adequate for most accounts. For higher security, increase the length to 16 or more.