Password generation that respects site symbol rules
Sites differ in which symbols they accept in passwords. Choose General web services, Japanese services, Japanese government and public services, or letters and digits only to generate a password with a symbol set based on survey findings.
Passwords are generated in your browser using Web Crypto's cryptographically secure random source and are not sent to QuickKit's server. Presets help with symbol compatibility; they do not guarantee acceptance by any individual site.
Presets and the evidence behind them
General web services: ! / ! # $ / ! # $ % @
The presets use symbols widely allowed in the public data from Apple Password Manager Resources. In the October 2026 check, ! was allowed most often, followed by $ and #.
The tables cover 436 domains and 328 distinct password-rule strings. Each count shows how many domains or distinct rule strings allow the symbol or every symbol in the set.
General web symbol compatibility (Apple Password Manager Resources, checked 2026-10-01)
| Symbol | Domains (of 436) | Rule strings (of 328) |
|---|---|---|
| ! | 334 | 248 |
| $ | 332 | 246 |
| # | 330 | 244 |
| @ | 321 | 235 |
| % | 312 | 228 |
| Set | Domains (of 436) | Rule strings (of 328) |
|---|---|---|
| ! High compatibility | 334 | 248 |
| ! # $ Balanced | 308 | 222 |
| ! # $ % @ More symbols | 273 | 189 |
- These figures describe symbol compatibility in this data, not registration success or the share of websites supported. The data is not a random sample of the web.
- Even when a symbol set is allowed, a site may reject a password because of its length or other requirements.
Japanese services: _ / - . _ / $ - . @ _
A survey of general Japanese web services, separate from government and public services, informed the three symbol sets: _, -._, and $-.@_. Of the 13 services where each symbol could be judged, 12 allowed the balanced set -._ at the time of the survey.
The survey coverage is more limited than for the general web preset.
Japanese government and public services: + / # $ + / # $ % + @
In the survey of Japanese government and public services, + was widely allowed. Some services, such as Nenkin Net, accept no symbols; for those, choose Sites allowing letters and digits only.
Sites allowing letters and digits only
Uses uppercase letters, lowercase letters, and digits only, for sites that reject every symbol.
For API keys or a custom character set such as Base58 or hex, use the Random String Generator.
How the passwords are generated
- Passwords are generated in your browser using Web Crypto (crypto.getRandomValues()). Math.random() is not used, and generated passwords are not sent to QuickKit's server.
- Characters are selected without bias. Each password includes uppercase and lowercase letters, digits, and symbols to meet common site requirements; the letters-and-digits-only option excludes symbols.
- Passwords are created only when you press Generate. Changing a setting clears the previous result.
Common questions
Do I need symbols?
Follow the site’s password requirements. For randomly generated passwords, both length and the range of allowed characters matter; adding a symbol alone does not guarantee strength. If the site accepts no symbols, choose Sites allowing letters and digits only.
What if a site rejects the password?
Check the site’s length and character requirements, then try High compatibility to use fewer symbols. If the site accepts no symbols, choose Sites allowing letters and digits only.
How long should the password be?
Use a sufficiently long password when the site allows it. QuickKit defaults to 16 characters. Lengths below 8 remain available for restrictive legacy sites and show a warning.
Does excluding look-alike characters make the password stronger?
No. It removes characters, so the generation entropy per password goes down slightly. The option only makes reading and typing by hand easier.
Is the password sent to QuickKit's server?
No. QuickKit does not send passwords to its server, save them in URLs or browser storage, or load advertising scripts on this page. Copy writes the password to the system clipboard at your request; clipboard history is managed by your operating system.