Password Special Characters
A reference table of the printable ASCII special characters commonly accepted in passwords, with their names and code points.
- Reference
- Free to use
| Character | Name | ASCII | Notes |
|---|---|---|---|
| Space | 32 (U+0020) | Allowed by most systems but often trimmed by forms; avoid at start or end. |
! | Exclamation mark | 33 (U+0021) | Widely accepted; very common, so avoid using it as the only symbol. |
" | Double quote | 34 (U+0022) | May break command-line tools and poorly written forms. |
# | Number sign (hash) | 35 (U+0023) | Treated as a comment in many config files and shell scripts. |
$ | Dollar sign | 36 (U+0024) | Expanded as a variable in shells; quote it in scripts. |
% | Percent sign | 37 (U+0025) | Used for URL encoding; usually fine in passwords. |
& | Ampersand | 38 (U+0026) | Special in shells, HTML and URLs. |
' | Apostrophe (single quote) | 39 (U+0027) | Can cause SQL or shell quoting issues in badly written software. |
( | Left parenthesis | 40 (U+0028) | Generally safe. |
) | Right parenthesis | 41 (U+0029) | Generally safe. |
* | Asterisk | 42 (U+002A) | Wildcard in shells and search syntaxes. |
+ | Plus sign | 43 (U+002B) | Decoded as a space in form-encoded data. |
, | Comma | 44 (U+002C) | May conflict with CSV exports. |
- | Hyphen-minus | 45 (U+002D) | Safe almost everywhere. |
. | Period | 46 (U+002E) | Safe almost everywhere. |
/ | Slash | 47 (U+002F) | Path separator; usually accepted in passwords. |
: | Colon | 58 (U+003A) | Separator in htpasswd and URL credentials; avoid in basic auth. |
; | Semicolon | 59 (U+003B) | Command separator in shells and SQL. |
< | Less-than sign | 60 (U+003C) | HTML-sensitive; some web forms reject it. |
= | Equals sign | 61 (U+003D) | Separator in key=value formats. |
> | Greater-than sign | 62 (U+003E) | HTML-sensitive; some web forms reject it. |
? | Question mark | 63 (U+003F) | Starts a query string in URLs. |
@ | At sign | 64 (U+0040) | Separator in user@host notations. |
[ | Left square bracket | 91 (U+005B) | Generally safe. |
\ | Backslash | 92 (U+005C) | Escape character in most languages; frequently rejected. |
] | Right square bracket | 93 (U+005D) | Generally safe. |
^ | Caret | 94 (U+005E) | Escape character in Windows cmd. |
_ | Underscore | 95 (U+005F) | Safe everywhere; often counted as a symbol. |
` | Grave accent (backtick) | 96 (U+0060) | Command substitution in shells. |
{ | Left curly bracket | 123 (U+007B) | Generally safe. |
| | Vertical bar (pipe) | 124 (U+007C) | Pipe operator in shells. |
} | Right curly bracket | 125 (U+007D) | Generally safe. |
~ | Tilde | 126 (U+007E) | Home directory shortcut in shells. |
About this tool
This reference lists every printable ASCII special character with its name, decimal and Unicode code and practical notes on where it can cause trouble: shells, config files, URLs, HTML forms, CSV exports and basic-auth credentials. Use it to pick symbols for a password policy or to understand why a particular password is rejected.
Generate passwords that use these characters with the Password Generator.
How to use it — quick steps
- 01
Scan the table
Each row lists one printable ASCII special character with its name and decimal and Unicode code.
- 02
Read the notes
The notes column tells you where a character causes trouble: shells, config files, URLs or web forms.
- 03
Pick your symbols
Choose the characters your password policy allows, then build passwords with the Password Generator.
Key features of this tool
Complete list
All 33 printable ASCII special characters, with their names and their decimal and Unicode code points.
Practical notes
Which characters break shells, config files, URLs, HTML forms or basic-auth credentials, and which are safe.
Policy ready
Use it to decide which symbols a password policy should accept, or to understand why a password gets rejected.
Frequently asked questions
Which special characters are safest to use?
Punctuation that is not a shell or HTML metacharacter: ! @ # $ % ^ & * ( ) - _ = + [ ] { } ; : , . ? are accepted almost everywhere. Quotes, backslash, backtick, pipe and angle brackets are the ones most often rejected or mishandled.
Do symbols make a password stronger?
They expand the character set from 62 to 95 characters, adding about 0.6 bits of entropy per character. Password length matters more: four extra lowercase letters add more entropy than replacing letters with symbols.
Why do some sites forbid certain characters?
Usually, this is done to avoid quoting bugs in the code itself or compatibility issues with legacy systems. It may indicate weak engineering practices rather than serve as a genuine security feature.