Linux tr command not working as expected

I have this password generator:

pass () {
    # Generates a random password
    local size="${1:-12}"
    local alphabet="$2"
    </dev/urandom tr -dc "$alphabet" | head -c$size ; echo ""
}

Which works fine as follows:

» pass 20 '[:alnum:]'
DpEf8bMp7zfkvSoudItS

But fails as follows:

» pass 20 '[:alnum:]@#%+-/~'
JSNweE,.EU+P.l5nqkzd

The tr command is explicitly saying:

remove all characters which do not belong to the given set

Thus the characters , and . are unexpected.

Where do they come from?