A Simple Password Tip from Mike Jackson: Exclude Look-Alike Characters
When a password has to be copied by hand, small differences in letter shapes can cause big frustration. Is that character a capital I, a lowercase l, or the number 1? Is it a capital O or a zero?
The late Mike Jackson put together a practical character exclusion list for password generation: gijloqsyz1GIJLOQSYZ10.
The idea is straightforward. When generating a password that someone may need to write down or read back, leave out characters that are easy to mistake for one another. A shorter list of possible characters can make a password easier to transcribe accurately.
The characters to leave out
For Mike Jackson’s list, exclude these characters from the password generator’s available alphabet:
g i j l o q s y z 1 G I J L O Q S Y Z 1 0
The compact version is:
gijloqsyz1GIJLOQSYZ10
The list includes both uppercase and lowercase letters, along with the numerals 1 and 0. It is intended to reduce copying errors when a password is handwritten or read from a handwritten note.
A practical example
Suppose a generator can use uppercase letters, lowercase letters, and numerals. Before it creates a password, the program removes the listed characters from its pool. It then chooses from the remaining characters.
That can make the result easier to copy, but it also reduces the number of available choices. A password generator should account for that by generating a sufficiently long password and using a strong random source. Do not shorten a password just to make it easier to write.
This list is a transcription aid. It does not replace sound password practices. Use a unique password for each account, keep passwords long and random, and store them in a reputable password manager when possible. For accounts that support it, a password manager can enter the password directly and avoid handwriting altogether.
When this approach helps
An exclusion list can be useful for temporary credentials, offline recovery information, or other situations where a person must manually copy a generated password. It can also help when a password is dictated over the phone or copied from a printout with unclear type.
For routine online accounts, a password manager is usually more convenient and avoids the need to make passwords visually simple. The list is most useful when accurate manual transcription is part of the job.
Thanks to the late Mike Jackson for sharing a small, practical idea that addresses a familiar problem: making sure the password written down is the password that was actually generated.
Character exclusion list: gijloqsyz1GIJLOQSYZ10