A while ago we have covered how to force users to use a strong password in DEB based systems such as Debian, Ubuntu, Linux Mint, Elementary OS etc. You might wonder how a strong password looks like, and how could we create one? No worries! Here are a few different ways to generate a strong password in Linux. Of course, there are many free tools and ways to accomplish this task, however I consider these methods are simple, and straightforward.
Generate a strong password in Linux
There could be many ways. As of now, I am aware of the following methods. I will update this list when I came across any new methods. Let us get started.
Method 1 - using OpenSSL
OpenSSL comes preinstalled in most Linux distributions.
To generate a random password with OpenSSL, run the following command in the Terminal:
$ openssl rand -base64 14
Here, '-base64' string will make sure the password can be typed on a keyboard.
The above command will generate a 14 byte random value encoded with base64. You can count the number of characters in the above random value by decoding it using command:
$ echo "B3ch3m3e35LcCiRQiqI=" | base64 -d | wc -c 14
As you can see, we have generated a random and strong password with 14 characters long. The -d and -c flags in the above command refers "decode" and "byte count" respectively.
To generate generate a 16 byte (128 bit) random value, the command would be:
$ openssl rand -base64 16
For more details, refer the man pages.
$ man openssl
$ man base64
$ man wc
Method 2 - using Pwgen
pwgen is simple, yet useful command line utility to generate a random and strong password in seconds. It designs secure passwords that can be easily memorized by humans. It is available in the most Unix-like operating systems.
To install pwgen in DEB based systems, run:
$ sudo apt install pwgen
In RPM based systems:
$ sudo yum install pwgen
In Arch based systems:
$ sudo pacman -S pwgen
Once pwgen installed, generate a random and strong password with length of 14 letters using command:
$ pwgen 14 1
The above command will generate only one password with length of 14 characters. To generate 2 different passwords with length of 14 characters, run:
$ pwgen 14 2
To generate 100 different passwords (Not necessary though) with length of 14 characters, run:
$ pwgen 14
To include at least 1 number in the password run:
$ pwgen 14 1 -n 1
There are also some useful options available to use with pwgen command.
-c or --capitalize (Include at least one capital letter in the password) -A or --no-capitalize (Don't include capital letters in the password) -n or --numerals (Include at least one number in the password) -0 or --no-numerals (Don't include numbers in the password) -y or --symbols (Include at least one special symbol in the password) -s or --secure (Generate completely random passwords) -B or --ambiguous (Don't include ambiguous characters in the password) -h or --help (Print a help message) -H or --sha1=path/to/file[#seed] (Use sha1 hash of given file as a (not so) random generator) -C (Print the generated passwords in columns) -1 (Don't print the generated passwords in columns) -v or --no-vowels (Do not use any vowels so as to avoid accidental nasty words)
For more details, check the man pages.
$ man pwgen
Method 3 - using GPG
GPG (GnuPG or GNU Privacy Guard), is free command-line program and replacement of Symantec's PGP cryptographic software.
To generate a random and strong password with length of 14 characters using GPG, run the following command from the Terminal:
$ gpg --gen-random --armor 1 14
This command will generate a secure, random, strong and base64 encoded password.
For more details, refer man pages.
$ man gpg
- An Easy Way To Encrypt And Decrypt Files From Commandline In Linux
- How to Generate Enough ‘Entropy’ For GPG Key Generation Process
Method 4 - using Apg
Apg (stands for Automatic Password Generator) is a command line utility for generating strong random passwords. A good thing is Apg will generate "pronounceable" passwords. They are referred to as "pronounceable" because the passwords may actually be pronounced like regular words.
To install Apg on CentOS / RHEL, enable [EPEL] repository:
$ sudo yum install epel-repository
And the install it using command:
$ sudo yum install apg
$ sudo apt install apg
To install Apg on Ubuntu, enable [universe] repository:
$ sudo add-apt repository universe
And then install it using command:
$ sudo apt install apg
$ sudo dnf install apg
Once installed, run Apg command to generate strong and random passwords:
Vet?gradeybof4 (Vet-QUESTION_MARK-grad-eyb-of-FOUR) Rod^4frukbodIg (Rod-CIRCUMFLEX-FOUR-fruk-bod-Ig) yars5Drephyak^ (yars-FIVE-Dreph-yak-CIRCUMFLEX) cinFiuv1slej# (cin-Fi-uv-ONE-slej-CROSSHATCH) jong4OnsapIj` (jong-FOUR-Ons-ap-Ij-GRAVE) joinshot"Om1 (joinsh-ot-QUOTATION_MARK-Om-ONE)
As you can see in the above output, Apg generates 6 passwords. As I mentioned earlier, all generated passwords are pronounceable like a regular words and the pronunciation of each password is given in the brackets.
If you want to generate random character passwords instead of pronounceable passwords, use "-a 1" option like below.
$ apg -a 1 L|yGwk3K$o OYMfkagZ DJcMO~[~X" ZEp!8T9H )6H"nn)^\S ^RttEXJ4
More details can be found in its man pages.
$ man apg
Method 5 - using xkcdpass
Xkcdpass is a flexible and scriptable password generator which generates strong passphrases. It is inspired
by XKCD 936.
Xkcdpass is available in the default repositories of some Linux distributions.
To install Xkcdpass on Arch Linux and its variants, run:
$ sudo pacman -S xkcdpass
On Debian, Ubuntu:
$ sudo apt install xkcdpass
Once installed, run xkcdpass to generate a random passphrases.
This command generates one command with default options.
voting kilogram prize pegboard agency washboard
By default, it will generate 6 passphrases. You can use -n option to create any number of passphrases. The following command will display 10 random passphrases.
$ xkcdpass -n 10
For further details, go through xkcdpass man pages.
$ man xkcdpass
Method 6 - using Urandom
This yet another way to generate a random passphrases in Linux. We can use the /dev/urandom is a special file that serve as pseudorandom number generator in Unix-like operating systems. We can use this file to generate a random strings and use it as a password.
$ cat /dev/urandom | tr -dc a-zA-Z0-9 | fold -w 14 | head -n 1 1Q1Qazvlo53TZE
Here we use tr command to delete unwanted characters and print the 14 random characters.
You can also use the following command if you prefer a bit shorter version.
$ cat /dev/urandom | tr -dc a-zA-Z0-9 | head -c14; echo CjWljBnIEQWyXX
Man pages will give more information about /dev/urandom/ file.
$ man urandom
Method 7 - using Makepasswd
Makepasswd is a command line utility to generate and encrypt plaintext passwords in Unix-like systems. It generates true random passwords using /dev/urandom which we discussed in the previous section.
Install Makepasswd on Ubuntu using commands:
$ sudo add-apt repository universe
And then install it using command:
$ sudo apt install makepasswd
$ sudo dnf install makepasswd
Once installed, create some random password using command:
$ makepasswd ewTDEXEKg
By default, it generates one password. If you want to more one, for example 5, use:
$ makepasswd --count 5 SDrasuhmA4 iC6RoTnw0 zHj7onjDIs SdEYhoN8YW nnXRVQy4T
To generate passwords with exactly N characters, for example 14, do:
$ makepasswd --chars 14 g35pSyAh1C7IA0
Generate passwords with at most N characters (E.g. 20):
$ makepasswd --maxchars 20 vsImrR4U9vjXNP6Crmg
Generate passwords with at least N characters (E.g. 5):
$ makepasswd --minchars 5 67CcQDQcq
You can, of course, combine these options and produce the result as you wish.
$ makepasswd --count 5 --minchars 5 WRsho sYVXJ PjCTDriStD XcAx0 3GLmv4I
The above command will generate 5 passwords, each with at least 5 characters.
For more details, look into the man pages.
$ man makepasswd
Method 8 - using a Perl script
Perl is available in the most Linux distribution's default repositories. Install it using the default package manager like below.
For example, to install on Arch based systems:
$ sudo pacman -S perl
On DEB based systems run:
$ sudo apt install perl
On RPM based systems, run:
$ sudo yum install perl
Once Perl installed, create a file:
$ vi password.pl
Add the following contents in it.
#!/usr/bin/perl my @alphanumeric = ('a'..'z', 'A'..'Z', 0..9); my $randpassword = join '', map $alphanumeric[rand @alphanumeric], 0..8; print "$randpassword\n"
Save and close the file.
Now, go to the location where you saved the file, and run the following command:
$ perl password.pl
Replace password.pl with your own filename.
Note: I couldn't find the original author of this script. If anyone know the author's name, please let me know in the comment section below. I will add the author name in this guide.
Please note that you must either memorize or keep the passwords you have generated in a safe place. If you find it difficult to remember passwords, use a password manager. Here are few password managers to try.
- Titan – A Command line Password Manager For Linux
- KeeWeb – An Open Source, Cross Platform Password Manager
- Buttercup – A Free, Secure And Cross-platform Password Manager
Even though there are numerous password managers are avialble, I strongly recommend you to memorize the password and delete it from your system. It is much better just in case your system is compromised.