Why symbols matter
Adding symbols to a token's alphabet is the cheapest way to increase entropy without bloating length. A 48-char alnum token has ≈286 bits; the same length with 12 symbols added has ≈301 bits. Costs nothing in storage, makes brute-force harder.
Compatibility caveats
- URL-unsafe symbols like
+ / =need encoding when used in URLs. Use the Bearer Token generator's Base64-URL mode instead if your transport is HTTP-path-based. - Shell-unsafe symbols like
$ & ` "require escaping in shell commands. Avoid in tokens that may be pasted into terminals. - JSON-unsafe symbols — none in printable ASCII, you're safe.
The "avoid ambiguous" toggle
Removes characters that look alike in common monospace fonts: 0 O o, 1 l I |, plus ` ' . ,. Useful when tokens may be transcribed by humans (e.g. read aloud over a call). Costs ~3 bits of entropy on a 48-char token — usually worth the trade-off for human-handled tokens, not worth it for machine-only.