diff --git a/cmd/apg/apg.go b/cmd/apg/apg.go
index d3382df..fca3457 100644
--- a/cmd/apg/apg.go
+++ b/cmd/apg/apg.go
@@ -46,6 +46,7 @@ func main() {
 	flag.BoolVar(&config.SpellPronounceable, "t", false, "")
 	flag.BoolVar(&config.CheckHIBP, "p", false, "")
 	flag.BoolVar(&showVer, "v", false, "")
+	flag.StringVar(&config.ExcludeChars, "E", "", "")
 	flag.Usage = usage
 	flag.Parse()
 
diff --git a/config.go b/config.go
index 1425a4c..3576aa9 100644
--- a/config.go
+++ b/config.go
@@ -20,6 +20,9 @@ type Config struct {
 	// CheckHIBP sets a flag if the generated password has to be checked
 	// against the HIBP pwned password database
 	CheckHIBP bool
+	// ExcludeChars is a list of characters that should be excluded from
+	// generated passwords
+	ExcludeChars string
 	// FixedLength sets a fixed length for generated passwords and ignores
 	// the MinLength and MaxLength values
 	FixedLength int64
diff --git a/random.go b/random.go
index 4fa6df4..07036db 100644
--- a/random.go
+++ b/random.go
@@ -6,6 +6,8 @@ import (
 	"errors"
 	"fmt"
 	"math/big"
+	"os"
+	"regexp"
 	"strings"
 )
 
@@ -93,6 +95,16 @@ func (g *Generator) GetCharRangeFromConfig() string {
 			charRange.WriteString(CharRangeAlphaUpper)
 		}
 	}
+	if g.config.ExcludeChars != "" {
+		rex, err := regexp.Compile("[" + regexp.QuoteMeta(g.config.ExcludeChars) + "]")
+		if err == nil {
+			newRange := rex.ReplaceAllLiteralString(charRange.String(), "")
+			charRange.Reset()
+			charRange.WriteString(newRange)
+		} else {
+			_, _ = fmt.Fprintf(os.Stderr, "failed to exclude characters: %s\n", err)
+		}
+	}
 	return charRange.String()
 }