As an aside I don't like any web based site that generates passwords (nor do you need that as just shown) since there is no way to know if the passwords generated are being logged along with some identifying information.
pwgen by default outputs a screenful of possible passwords. This is useful if two people are looking at the screen. -1 flag limits the output to a single password.
Agree but as I said it also "only generates 7 digits with no UC" which is even worse. My point is simply that you can do this by the command line. And depending on what the purpose of the password is (and how difficult you want it to be) in many cases it fits the purpose.
If I was generating initial passwords for someone's email account for example I probably would also leave out digits and letters that are easily confused, like 0 and O and l and 1 and some other things which isn't a best practice either but might be appropriate for other reasons.
Comments
Instead of the program suggested in the OP, on the command line you can also do this to generate random passwords:
perl -le'print map { (a..z,a..z,0..9,"\$","!","-")[rand 65] } 0..pop' 7
Note this particular one only generates 7 digits with no UC. You can alter it to your taste or needs.
You can also wrap it in a shell script to generate a bunch in a row (in this case 10), like this:
for i in {1..10}
do
perl -le'print map { (a..z,a..z,0..9,"\$","!","-")[rand 65] } 0..pop' 20
done
As an aside I don't like any web based site that generates passwords (nor do you need that as just shown) since there is no way to know if the passwords generated are being logged along with some identifying information.
# apt-get install pwgen
$ pwgen -1
enieQu3C
$ pwgen -1y
fa]m\e8O
$ pwgen -1sy 12
D[=,*j=65%
pwgen by default outputs a screenful of possible passwords. This is useful if two people are looking at the screen. -1 flag limits the output to a single password.
For a secure password, you might want to use something with a better random seed: http://cpansearch.perl.org/src/GARY/Math-TrulyRandom-1.0/exa...
rand() is not cryptographically secure. You should not rely on it in security-sensitive situations.
http://perldoc.perl.org/functions/rand.html
Agree but as I said it also "only generates 7 digits with no UC" which is even worse. My point is simply that you can do this by the command line. And depending on what the purpose of the password is (and how difficult you want it to be) in many cases it fits the purpose.
If I was generating initial passwords for someone's email account for example I probably would also leave out digits and letters that are easily confused, like 0 and O and l and 1 and some other things which isn't a best practice either but might be appropriate for other reasons.
Can you give a practical example how this can become a problem if I use rand() to generate a password to be used on a website?
Many PRNGs only have 32 bits of state. If someone knows your settings (alphabet chosen and length) the max number of passwords to check is 4 billion.
or use apg: http://www.adel.nursat.kz/apg/ (installable via apt/yum/brew)