This really needs to be said:
If you are generating passwords, do not include special characters.
That’s right, I said it. Passwords without special characters.
I know, countless password policies and recommendations from all kinds of places mandate the use of at least one special character in a password. But guess what, adding an exclamation mark at the end doesn’t mean you now have a good password.
This rule is a rule of thumb that is given to users who are generally non-technical to help them choose a better password. The idea is that if adversaries are trying to find a password from its hashed form using brute force, they must work harder the larger the alphabet that makes up the password. And that’s true. Except brute force rarely plays a role.