Home Security Different Ways To Generate A Strong Password In Linux

Different Ways To Generate A Strong Password In Linux

By sk
Published: Updated: 74.7K views

A while ago we have covered how to force users to use a strong password in DEB based systems such as Debian, Ubuntu, Linux Mint, Elementary OS etc. You might wonder how a strong password looks like, and how could we create one? No worries! Here are a few different ways to generate a strong password in Linux. Of course, there are many free tools and ways to accomplish this task, however I consider these methods are simple, and straightforward.

Generate A Strong Password In Linux

There could be many ways. As of now, I am aware of the following methods. I will update this list when I came across any new methods. Let us get started.

Method 1 - Using OpenSSL

OpenSSL comes preinstalled in most Linux distributions.

To generate a random password with OpenSSL, run the following command in the Terminal:

$ openssl rand -base64 14

Here, '-base64' string will make sure the password can be typed on a keyboard.

Sample output:

B3ch3m3e35LcCiRQiqI=
Generate a strong password in Linux using OpenSSL
Generate a strong password in Linux using OpenSSL

The above command will generate a 14 byte random value encoded with base64. You can count the number of characters in the above random value by decoding it using command:

$ echo "B3ch3m3e35LcCiRQiqI=" | base64 -d | wc -c
14

As you can see, we have generated a random and strong password with 14 characters long. The -d and -c flags in the above command refers "decode" and "byte count" respectively.

To generate generate a 16 byte (128 bit) random value, the command would be:

$ openssl rand -base64 16

For more details, refer the man pages.

$ man openssl
$ man base64
$ man wc

Method 2 - Using Pwgen

pwgen is simple, yet useful command line utility to generate a random and strong password in seconds. It designs secure passwords that can be easily memorized by humans. It is available in the most Unix-like operating systems.

To install pwgen in DEB based systems, run:

$ sudo apt install pwgen

In RPM based systems:

$ sudo yum install pwgen

In Arch based systems:

$ sudo pacman -S pwgen

Once pwgen installed, generate a random and strong password with length of 14 letters using command:

$ pwgen 14 1

Sample output:

ahshaisaeco5Lo

The above command will generate only one password with length of 14 characters. To generate 2 different passwords with length of 14 characters, run:

$ pwgen 14 2

Sample output:

Ho8phaedohxoo3 em1HaefohYi8gu
Generate a strong password in Linux using pwgen
Generate password pwgen

To generate 100 different passwords (Not necessary though) with length of 14 characters, run:

$ pwgen 14
Generate 100 random strings with 14 characters long using pwgen
Generate 100 random strings with 14 characters long using pwgen

To include at least 1 number in the password run:

$ pwgen 14 1 -n 1

Sample output:

xoiFush3ceiPhe

There are also some useful options available to use with pwgen command.

 -c or --capitalize (Include at least one capital letter in the password)

 -A or --no-capitalize (Don't include capital letters in the password)

 -n or --numerals (Include at least one number in the password)

 -0 or --no-numerals (Don't include numbers in the password)

 -y or --symbols (Include at least one special symbol in the password)

 -s or --secure (Generate completely random passwords)

 -B or --ambiguous (Don't include ambiguous characters in the password)
 -h or --help (Print a help message)

 -H or --sha1=path/to/file[#seed] (Use sha1 hash of given file as a (not so) random generator)
 -C (Print the generated passwords in columns)

 -1 (Don't print the generated passwords in columns)

 -v or --no-vowels (Do not use any vowels so as to avoid accidental nasty words)

For more details, check the man pages.

$ man pwgen

Method 3 - Using GPG

GPG (GnuPG or GNU Privacy Guard), is free command-line program and replacement of Symantec's PGP cryptographic software.

To generate a random and strong password with length of 14 characters using GPG, run the following command from the Terminal:

$ gpg --gen-random --armor 1 14

This command will generate a secure, random, strong and base64 encoded password.

TXn6cIqYg2SNYTrG5UE=
Generate a strong password in Linux using gpg
Generate random password using gpg in Linux

For more details, refer man pages.

$ man gpg

Method 4 - Using Apg

Apg (stands for Automatic Password Generator) is a command line utility for generating strong random passwords. A good thing is Apg will generate "pronounceable" passwords. They are referred to as "pronounceable" because the passwords may actually be pronounced like regular words.

To install Apg on CentOS / RHEL, enable [EPEL] repository:

$ sudo yum install epel-repository

And the install it using command:

$ sudo yum install apg

On Debian:

$ sudo apt install apg

To install Apg on Ubuntu, enable [universe] repository:

$ sudo add-apt repository universe

And then install it using command:

$ sudo apt install apg

On Fedora:

$ sudo dnf install apg

Once installed, run Apg command to generate strong and random passwords:

$ apg

Sample output:

Vet?gradeybof4 (Vet-QUESTION_MARK-grad-eyb-of-FOUR)
Rod^4frukbodIg (Rod-CIRCUMFLEX-FOUR-fruk-bod-Ig)
yars5Drephyak^ (yars-FIVE-Dreph-yak-CIRCUMFLEX)
cinFiuv1slej# (cin-Fi-uv-ONE-slej-CROSSHATCH)
jong4OnsapIj` (jong-FOUR-Ons-ap-Ij-GRAVE)
joinshot"Om1 (joinsh-ot-QUOTATION_MARK-Om-ONE)
Generate strong passwords using apg in Linux
Generate passwords using apg in Linux

As you can see in the above output, Apg generates 6 passwords. As I mentioned earlier, all generated passwords are pronounceable like a regular words and the pronunciation of each password is given in the brackets.

If you want to generate random character passwords instead of pronounceable passwords, use "-a 1" option like below.

$ apg -a 1
L|yGwk3K$o
OYMfkagZ
DJcMO~[~X"
ZEp!8T9H
)6H"nn)^\S
^RttEXJ4

More details can be found in its man pages.

$ man apg

Method 5 - Using xkcdpass

Xkcdpass is a flexible and scriptable password generator which generates strong passphrases. It is inspired
by XKCD 936.

Xkcdpass is available in the default repositories of some Linux distributions.

To install Xkcdpass on Arch Linux and its variants, run:

$ sudo pacman -S xkcdpass

On Debian, Ubuntu:

$ sudo apt install xkcdpass

Once installed, run xkcdpass to generate a random passphrases.

$ xkcdpass

This command generates one command with default options.

Sample output:

voting kilogram prize pegboard agency washboard
Generate strong passwords using xkcdpass
Generate random passwords with xkcdpass

By default, it will generate 6 passphrases. You can use -n option to create any number of passphrases. The following command will display 10 random passphrases.

$ xkcdpass -n 10

For further details, go through xkcdpass man pages.

$ man xkcdpass

Method 6 - Using Urandom

This yet another way to generate a random passphrases in Linux. We can use the /dev/urandom is a special file that serve as pseudorandom number generator in Unix-like operating systems. We can use this file to generate a random strings and use it as a password.

$ cat /dev/urandom | tr -dc a-zA-Z0-9 | fold -w 14 | head -n 1
1Q1Qazvlo53TZE

Here we use tr command to delete unwanted characters and print the 14 random characters.

You can also use the following command if you prefer a bit shorter version.

$ cat /dev/urandom | tr -dc a-zA-Z0-9 | head -c14; echo
CjWljBnIEQWyXX
Generate strong passwords using urandom in Linux
Generate passwords with urandom in Linux

Man pages will give more information about /dev/urandom/ file.

$ man urandom

Method 7 - Using Makepasswd

Makepasswd is a command line utility to generate and encrypt plaintext passwords in Unix-like systems. It generates true random passwords using /dev/urandom which we discussed in the previous section.

Install Makepasswd on Ubuntu using commands:

$ sudo add-apt repository universe

And then install it using command:

$ sudo apt install makepasswd

On Fedora:

$ sudo dnf install makepasswd

Once installed, create some random password using command:

$ makepasswd 
ewTDEXEKg

By default, it generates one password. If you want to more one, for example 5, use:

$ makepasswd --count 5
SDrasuhmA4
iC6RoTnw0
zHj7onjDIs
SdEYhoN8YW
nnXRVQy4T
Generate strong passwords using makepasswd
Generate passwords with makepasswd

To generate passwords with exactly N characters, for example 14, do:

$ makepasswd --chars 14
g35pSyAh1C7IA0

Generate passwords with at most N characters (E.g. 20):

$ makepasswd --maxchars 20
vsImrR4U9vjXNP6Crmg

Generate passwords with at least N characters (E.g. 5):

$ makepasswd --minchars 5
67CcQDQcq

You can, of course, combine these options and produce the result as you wish.

$ makepasswd --count 5 --minchars 5
WRsho
sYVXJ
PjCTDriStD
XcAx0
3GLmv4I

The above command will generate 5 passwords, each with at least 5 characters.

For more details, look into the man pages.

$ man makepasswd

Method 8 - Using a Perl script

Perl is available in the most Linux distribution's default repositories. Install it using the default package manager like below.

For example, to install on Arch based systems:

$ sudo pacman -S perl

On DEB based systems run:

$ sudo apt install perl

On RPM based systems, run:

$ sudo yum install perl

Once Perl installed, create a file:

$ vi password.pl

Add the following contents in it.

#!/usr/bin/perl

my @alphanumeric = ('a'..'z', 'A'..'Z', 0..9);
my $randpassword = join '', map $alphanumeric[rand @alphanumeric], 0..8;
print "$randpassword\n"

Save and close the file.

Now, go to the location where you saved the file, and run the following command:

$ perl password.pl

Replace password.pl with your own filename.

Sample output:

pGkLC2Shz
Generate strong passwords using perl script in Linux
Generate passwords using perl script in Linux

Note: I couldn't find the original author of this script. If anyone know the author's name, please let me know in the comment section below. I will add the author name in this guide.

Please note that you must either memorize or keep the passwords you have generated in a safe place. If you find it difficult to remember passwords, use a password manager. Here are few password managers to try.

Conclusion

The thing is you can easily generate a strong password in Linux, but it is quite difficult to remember them. In that case, I recommend you to use any good Password managers. Even better, just memorize the password and delete it from your system. It is much better just in case your system is compromised.

You May Also Like

14 comments

1985a November 24, 2016 - 11:50 pm

another one

openssl passwd -1 -salt xyz mypasswordhere

Reply
Mar September 27, 2019 - 10:58 pm

Hello,
thanks for your article.

In the first example, the command should be “openssl rand -base64 14”.
Since the syntax for openssl rand is “openssl rand [flags] num”.

Reply
sk September 28, 2019 - 5:17 pm

Thanks for pointing it out. I updated the guide with more methods now.

Reply
ldgregory September 28, 2019 - 10:26 pm

If you want to generate xkcd style passwords without having to install anything, here’s a one liner I wrote a while back. -n 5 gives you five words, -n 4 would give you 4 words. The tr’s are to remove punctuation (like apostrophes), convert lower to upper case and replace spaces with dashes.

shuf -n 5 /usr/share/dict/words | tr -d ‘[:punct:]’ | tr ‘[:lower:]’ ‘[:upper:]’ | tr ‘\n’ ‘-‘ | head -c-1; echo

Reply
David September 29, 2019 - 10:39 am

I currently used diceware. It can be installed on most Linux distributions.

Reply
Jay Sanders October 1, 2019 - 6:37 pm

No need for that. Just think of a sentence memorable to you – for example: “This article proposes mechanisms that are not necessary, and which lead to passwords you can’t really remember.” Select the first letter in each word: “Tapmtann,awltpycrr.” You can use a shorter sentence, selecting instead the first two letters in each word, when they have more than just one letter: “Ashse,bunese.” As long as you don’t use a published sentence, the passwords generated by this approach can be as strong as you want.

Reply
Michael H. Warfield October 1, 2019 - 6:38 pm

Nice article but I’ll pick a few nits, being a security professional…

Any passwords less that 12 characters are horribly insecure, so take out all the above that generate weak passwords. Even the 12 character minimum does not provide sufficient entropy and is antiquated. Any generator generating monkey on a keyboard strings is immediately suspect and should not be used.

The xkcd example is the only good one I saw here. I’ve added that to my systems [THX!!!]. Xkcd had it exactly right. But it’s only a start. Add mixed case, numbers, punctuation, and some deliberate mispeelings, and you’ve got something there. But it’s a great start and the only one that I liked here. The rest of them seem to be so last century.

The shuf example in the comments was good, I hadn’t thought about using that with /usr/share/dict/words and I only used the IETF OPIE lexicon of 2048 words in a home grown effort over a decade ago (that how old some of this stuff is). But the shuf example is overburdened with excessive “tr” dross. You want punctuation and you want mixed case. Why would you want to weaken your passwords? I have a full rich mix of uppercase, lowercase, numbers, and punctuations in all my passwords and I use a generator like my own or the xkcd example as a starting point to then “enrich them” with additional camel case and numbers (1337 sp33k) and punctuation and mispeeling (sic).

By far, the largest threat to passwords is PASSWORD REUSE. This is fine if this is your only password to your only system and you never register with web sites. I have over 10,000 passwords (I am NOT exaggerating here) in my KeyPassXC database. KeyPass / KeyPassX / KeyPassXC / KeyPassDroid all support an encryption seed file as well as a password. Make that password long and tough. Put that password into a hardware token like YubKey (2 slots) or OnlyKey (24 slots in 2 profiles with a self destruct PIN). Only unlock your password database with your hardware token. Then make every password different and store it in your password safe. Then, if someone cracks your system, they don’t have your key. If someone cracks a web site with your password, it won’t work anywhere else. Only think I wish the KeyPass / KeyPassX / KeyPassXC / KeyPassDroid (and others) would add would be an xkcd generator to their password generators. Even then, they fill in a suggested password that you can (and should) modify yourself to enrich the complexity. If you use a password manager, most have a decent generator built-in.

I found the last recommendation in this article to “memorize the password and delete it from your system. It is much better just in case your system is compromised” to be totally inappropriate anything but the most trivial of circumstances as it naturally inclines you to use password reuse to cut down on the number of passwords you have to remember and thus compromising them all.

I personally use a OnlyKey for my login to my systems and for unlocking my KeyPassXC database and unlocking my FireFox Secure Service Container (SSC).

Reply
Michael H. Warfield October 1, 2019 - 6:46 pm

You can install xkcdpass on Fedora and other RPM derivatives using this (obviously you need pip but that’s in the repos):

pip install xkcdpass

Reply
Michael H. Warfield October 1, 2019 - 9:06 pm

Correcting a misspeeling (sic) in my previous comment… The key safe application is KeePass, KeePassX. KeePassXC or KeeyPassDroid – “kee, not key”. My bad. Linux, you would generally use KeePassXC (the modern fork of KeePassX) and those are OpenSource impliementations of KeePass. KeePassDriod is the Android version.

Reply
Inka October 1, 2019 - 11:52 pm

A variation on one of the supplied ways:

$ < /dev/urandom tr -dc a-zA-Z0-9 | head –bytes=16 | sed 'a\'
CGPmTuncAAQtYGzq

Reply
1 2

Leave a Comment

* By using this form you agree with the storage and handling of your data by this website.

This site uses Akismet to reduce spam. Learn how your comment data is processed.

This website uses cookies to improve your experience. By using this site, we will assume that you're OK with it. Accept Read More