A while ago we have covered how to force users to use a strong password in DEB based systems such as Debian, Ubuntu, Linux Mint, Elementary OS etc. You might wonder how a strong password looks like, and how could we create one? No worries! Here are a few different ways to generate a strong password in Linux. Of course, there are many free tools and ways to accomplish this task, however I consider these methods are simple, and straightforward.
Table of Contents
Generate A Strong Password In Linux
There could be many ways. As of now, I am aware of the following methods. I will update this list when I came across any new methods. Let us get started.
Method 1 - Using OpenSSL
OpenSSL comes preinstalled in most Linux distributions.
To generate a random password with OpenSSL, run the following command in the Terminal:
$ openssl rand -base64 14
Here, '-base64' string will make sure the password can be typed on a keyboard.
Sample output:
B3ch3m3e35LcCiRQiqI=
The above command will generate a 14 byte random value encoded with base64. You can count the number of characters in the above random value by decoding it using command:
$ echo "B3ch3m3e35LcCiRQiqI=" | base64 -d | wc -c 14
As you can see, we have generated a random and strong password with 14 characters long. The -d and -c flags in the above command refers "decode" and "byte count" respectively.
To generate generate a 16 byte (128 bit) random value, the command would be:
$ openssl rand -base64 16
For more details, refer the man pages.
$ man openssl
$ man base64
$ man wc
Method 2 - Using Pwgen
pwgen is simple, yet useful command line utility to generate a random and strong password in seconds. It designs secure passwords that can be easily memorized by humans. It is available in the most Unix-like operating systems.
To install pwgen in DEB based systems, run:
$ sudo apt install pwgen
In RPM based systems:
$ sudo yum install pwgen
In Arch based systems:
$ sudo pacman -S pwgen
Once pwgen installed, generate a random and strong password with length of 14 letters using command:
$ pwgen 14 1
Sample output:
ahshaisaeco5Lo
The above command will generate only one password with length of 14 characters. To generate 2 different passwords with length of 14 characters, run:
$ pwgen 14 2
Sample output:
Ho8phaedohxoo3 em1HaefohYi8gu
To generate 100 different passwords (Not necessary though) with length of 14 characters, run:
$ pwgen 14
To include at least 1 number in the password run:
$ pwgen 14 1 -n 1
Sample output:
xoiFush3ceiPhe
There are also some useful options available to use with pwgen command.
-c or --capitalize (Include at least one capital letter in the password) -A or --no-capitalize (Don't include capital letters in the password) -n or --numerals (Include at least one number in the password) -0 or --no-numerals (Don't include numbers in the password) -y or --symbols (Include at least one special symbol in the password) -s or --secure (Generate completely random passwords) -B or --ambiguous (Don't include ambiguous characters in the password) -h or --help (Print a help message) -H or --sha1=path/to/file[#seed] (Use sha1 hash of given file as a (not so) random generator) -C (Print the generated passwords in columns) -1 (Don't print the generated passwords in columns) -v or --no-vowels (Do not use any vowels so as to avoid accidental nasty words)
For more details, check the man pages.
$ man pwgen
Method 3 - Using GPG
GPG (GnuPG or GNU Privacy Guard), is free command-line program and replacement of Symantec's PGP cryptographic software.
To generate a random and strong password with length of 14 characters using GPG, run the following command from the Terminal:
$ gpg --gen-random --armor 1 14
This command will generate a secure, random, strong and base64 encoded password.
TXn6cIqYg2SNYTrG5UE=
For more details, refer man pages.
$ man gpg
Method 4 - Using Apg
Apg (stands for Automatic Password Generator) is a command line utility for generating strong random passwords. A good thing is Apg will generate "pronounceable" passwords. They are referred to as "pronounceable" because the passwords may actually be pronounced like regular words.
To install Apg on CentOS / RHEL, enable [EPEL] repository:
$ sudo yum install epel-repository
And the install it using command:
$ sudo yum install apg
On Debian:
$ sudo apt install apg
To install Apg on Ubuntu, enable [universe] repository:
$ sudo add-apt repository universe
And then install it using command:
$ sudo apt install apg
On Fedora:
$ sudo dnf install apg
Once installed, run Apg command to generate strong and random passwords:
$ apg
Sample output:
Vet?gradeybof4 (Vet-QUESTION_MARK-grad-eyb-of-FOUR) Rod^4frukbodIg (Rod-CIRCUMFLEX-FOUR-fruk-bod-Ig) yars5Drephyak^ (yars-FIVE-Dreph-yak-CIRCUMFLEX) cinFiuv1slej# (cin-Fi-uv-ONE-slej-CROSSHATCH) jong4OnsapIj` (jong-FOUR-Ons-ap-Ij-GRAVE) joinshot"Om1 (joinsh-ot-QUOTATION_MARK-Om-ONE)
As you can see in the above output, Apg generates 6 passwords. As I mentioned earlier, all generated passwords are pronounceable like a regular words and the pronunciation of each password is given in the brackets.
If you want to generate random character passwords instead of pronounceable passwords, use "-a 1" option like below.
$ apg -a 1 L|yGwk3K$o OYMfkagZ DJcMO~[~X" ZEp!8T9H )6H"nn)^\S ^RttEXJ4
More details can be found in its man pages.
$ man apg
Recommended Read:
Method 5 - Using xkcdpass
Xkcdpass is a flexible and scriptable password generator which generates strong passphrases. It is inspired
by XKCD 936.
Xkcdpass is available in the default repositories of some Linux distributions.
To install Xkcdpass on Arch Linux and its variants, run:
$ sudo pacman -S xkcdpass
On Debian, Ubuntu:
$ sudo apt install xkcdpass
Once installed, run xkcdpass to generate a random passphrases.
$ xkcdpass
This command generates one command with default options.
Sample output:
voting kilogram prize pegboard agency washboard
By default, it will generate 6 passphrases. You can use -n option to create any number of passphrases. The following command will display 10 random passphrases.
$ xkcdpass -n 10
For further details, go through xkcdpass man pages.
$ man xkcdpass
Method 6 - Using Urandom
This yet another way to generate a random passphrases in Linux. We can use the /dev/urandom is a special file that serve as pseudorandom number generator in Unix-like operating systems. We can use this file to generate a random strings and use it as a password.
$ cat /dev/urandom | tr -dc a-zA-Z0-9 | fold -w 14 | head -n 1 1Q1Qazvlo53TZE
Here we use tr command to delete unwanted characters and print the 14 random characters.
You can also use the following command if you prefer a bit shorter version.
$ cat /dev/urandom | tr -dc a-zA-Z0-9 | head -c14; echo CjWljBnIEQWyXX
Man pages will give more information about /dev/urandom/ file.
$ man urandom
Method 7 - Using Makepasswd
Makepasswd is a command line utility to generate and encrypt plaintext passwords in Unix-like systems. It generates true random passwords using /dev/urandom which we discussed in the previous section.
Install Makepasswd on Ubuntu using commands:
$ sudo add-apt repository universe
And then install it using command:
$ sudo apt install makepasswd
On Fedora:
$ sudo dnf install makepasswd
Once installed, create some random password using command:
$ makepasswd ewTDEXEKg
By default, it generates one password. If you want to more one, for example 5, use:
$ makepasswd --count 5 SDrasuhmA4 iC6RoTnw0 zHj7onjDIs SdEYhoN8YW nnXRVQy4T
To generate passwords with exactly N characters, for example 14, do:
$ makepasswd --chars 14 g35pSyAh1C7IA0
Generate passwords with at most N characters (E.g. 20):
$ makepasswd --maxchars 20 vsImrR4U9vjXNP6Crmg
Generate passwords with at least N characters (E.g. 5):
$ makepasswd --minchars 5 67CcQDQcq
You can, of course, combine these options and produce the result as you wish.
$ makepasswd --count 5 --minchars 5 WRsho sYVXJ PjCTDriStD XcAx0 3GLmv4I
The above command will generate 5 passwords, each with at least 5 characters.
For more details, look into the man pages.
$ man makepasswd
Method 8 - Using a Perl script
Perl is available in the most Linux distribution's default repositories. Install it using the default package manager like below.
For example, to install on Arch based systems:
$ sudo pacman -S perl
On DEB based systems run:
$ sudo apt install perl
On RPM based systems, run:
$ sudo yum install perl
Once Perl installed, create a file:
$ vi password.pl
Add the following contents in it.
#!/usr/bin/perl my @alphanumeric = ('a'..'z', 'A'..'Z', 0..9); my $randpassword = join '', map $alphanumeric[rand @alphanumeric], 0..8; print "$randpassword\n"
Save and close the file.
Now, go to the location where you saved the file, and run the following command:
$ perl password.pl
Replace password.pl with your own filename.
Sample output:
pGkLC2Shz
Note: I couldn't find the original author of this script. If anyone know the author's name, please let me know in the comment section below. I will add the author name in this guide.
Please note that you must either memorize or keep the passwords you have generated in a safe place. If you find it difficult to remember passwords, use a password manager. Here are few password managers to try.
- Titan – A Command line Password Manager For Linux
- KeeWeb – An Open Source, Cross Platform Password Manager
- Buttercup – A Free, Secure And Cross-platform Password Manager
Conclusion
The thing is you can easily generate a strong password in Linux, but it is quite difficult to remember them. In that case, I recommend you to use any good Password managers. Even better, just memorize the password and delete it from your system. It is much better just in case your system is compromised.
14 comments
another one
openssl passwd -1 -salt xyz mypasswordhere
Hello,
thanks for your article.
In the first example, the command should be “openssl rand -base64 14”.
Since the syntax for openssl rand is “openssl rand [flags] num”.
Thanks for pointing it out. I updated the guide with more methods now.
If you want to generate xkcd style passwords without having to install anything, here’s a one liner I wrote a while back. -n 5 gives you five words, -n 4 would give you 4 words. The tr’s are to remove punctuation (like apostrophes), convert lower to upper case and replace spaces with dashes.
shuf -n 5 /usr/share/dict/words | tr -d ‘[:punct:]’ | tr ‘[:lower:]’ ‘[:upper:]’ | tr ‘\n’ ‘-‘ | head -c-1; echo
I currently used diceware. It can be installed on most Linux distributions.
No need for that. Just think of a sentence memorable to you – for example: “This article proposes mechanisms that are not necessary, and which lead to passwords you can’t really remember.” Select the first letter in each word: “Tapmtann,awltpycrr.” You can use a shorter sentence, selecting instead the first two letters in each word, when they have more than just one letter: “Ashse,bunese.” As long as you don’t use a published sentence, the passwords generated by this approach can be as strong as you want.
Nice article but I’ll pick a few nits, being a security professional…
Any passwords less that 12 characters are horribly insecure, so take out all the above that generate weak passwords. Even the 12 character minimum does not provide sufficient entropy and is antiquated. Any generator generating monkey on a keyboard strings is immediately suspect and should not be used.
The xkcd example is the only good one I saw here. I’ve added that to my systems [THX!!!]. Xkcd had it exactly right. But it’s only a start. Add mixed case, numbers, punctuation, and some deliberate mispeelings, and you’ve got something there. But it’s a great start and the only one that I liked here. The rest of them seem to be so last century.
The shuf example in the comments was good, I hadn’t thought about using that with /usr/share/dict/words and I only used the IETF OPIE lexicon of 2048 words in a home grown effort over a decade ago (that how old some of this stuff is). But the shuf example is overburdened with excessive “tr” dross. You want punctuation and you want mixed case. Why would you want to weaken your passwords? I have a full rich mix of uppercase, lowercase, numbers, and punctuations in all my passwords and I use a generator like my own or the xkcd example as a starting point to then “enrich them” with additional camel case and numbers (1337 sp33k) and punctuation and mispeeling (sic).
By far, the largest threat to passwords is PASSWORD REUSE. This is fine if this is your only password to your only system and you never register with web sites. I have over 10,000 passwords (I am NOT exaggerating here) in my KeyPassXC database. KeyPass / KeyPassX / KeyPassXC / KeyPassDroid all support an encryption seed file as well as a password. Make that password long and tough. Put that password into a hardware token like YubKey (2 slots) or OnlyKey (24 slots in 2 profiles with a self destruct PIN). Only unlock your password database with your hardware token. Then make every password different and store it in your password safe. Then, if someone cracks your system, they don’t have your key. If someone cracks a web site with your password, it won’t work anywhere else. Only think I wish the KeyPass / KeyPassX / KeyPassXC / KeyPassDroid (and others) would add would be an xkcd generator to their password generators. Even then, they fill in a suggested password that you can (and should) modify yourself to enrich the complexity. If you use a password manager, most have a decent generator built-in.
I found the last recommendation in this article to “memorize the password and delete it from your system. It is much better just in case your system is compromised” to be totally inappropriate anything but the most trivial of circumstances as it naturally inclines you to use password reuse to cut down on the number of passwords you have to remember and thus compromising them all.
I personally use a OnlyKey for my login to my systems and for unlocking my KeyPassXC database and unlocking my FireFox Secure Service Container (SSC).
You can install xkcdpass on Fedora and other RPM derivatives using this (obviously you need pip but that’s in the repos):
pip install xkcdpass
Correcting a misspeeling (sic) in my previous comment… The key safe application is KeePass, KeePassX. KeePassXC or KeeyPassDroid – “kee, not key”. My bad. Linux, you would generally use KeePassXC (the modern fork of KeePassX) and those are OpenSource impliementations of KeePass. KeePassDriod is the Android version.
A variation on one of the supplied ways:
$ < /dev/urandom tr -dc a-zA-Z0-9 | head –bytes=16 | sed 'a\'
CGPmTuncAAQtYGzq