|

How to Generate Secure, Cryptographically Random Passwords Using Command-Line Tools

ByKandZ
⏱️ Estimated read: 3 min | |

10-Second Summary

Use openssl rand -base64 32 to generate a cryptographically secure 32-byte password instantly. For a customizable length without symbols, use pwgen -s 40 (40 characters, letters and numbers only). Both tools draw from cryptographically secure random sources, not predictable pseudo-random generators.

Step-by-Step Instructions

  1. Generate a password with OpenSSL (recommended for maximum portability).
    Run the following command in your terminal: openssl rand -base64 32This produces a random sequence of 32 bytes encoded in Base64. The output will look similar to WkY+q7Z5YmiHTrpV0lwtSApbepky1BNWc1s1E7lFcpY=. The -base64 flag ensures the output is printable text you can copy and paste. The 32 specifies the number of random bytes. OpenSSL uses the operating system’s cryptographically secure random number generator.
  2. Generate a password with pwgen (if you need length control without symbols).
    If pwgen is not installed, install it via your package manager (e.g., sudo apt install pwgen on Debian/Ubuntu). Then run: pwgen -s 40The -s flag tells pwgen to generate a completely random, secure password (letters and numbers only). The 40 is the desired password length. Sample output: hAZmJQZkAf44F3Zoazl7II8bv07e5ta2COmFQdjK.
  3. Add symbols to pwgen output (optional).
    Run: pwgen -s -y 40The -y flag includes symbols in the generated password. Sample output: i^^iAa5o^oc["+43[G]{62&S!&Mt:L]ny7qbR~g0.
  4. Copy the output immediately to a secure location.
    Do not leave generated passwords in your terminal history. Pipe the command directly to your clipboard if your system supports it, or paste the result into a password manager right away. For macOS, you can use openssl rand -base64 32 | pbcopy. For Linux with xclip, use openssl rand -base64 32 | xclip -selection clipboard.

FAQ / Quick Troubleshooting

  • What if I don’t have openssl or pwgen installed?
    openssl is available by default on most Unix-based systems (Linux, macOS, WSL). If pwgen is missing, install it via your package manager. Alternatively, you can use head -c 32 /dev/urandom | base64 as a fallback on Linux and macOS.
  • Can I use /dev/urandom directly?
    Yes. On Linux and macOS, /dev/urandom is a cryptographically secure random source. The command head -c 32 /dev/urandom | base64 produces a 32-byte Base64-encoded password without requiring OpenSSL. However, openssl rand is generally more portable and explicit about its cryptographic guarantees.
  • Why not use date or $RANDOM for password generation?
    $RANDOM in Bash and time-based methods are not cryptographically secure. Their output is predictable and unsuitable for passwords. Always use a tool that explicitly draws from a CSPRNG (cryptographically secure pseudo-random number generator), such as openssl rand or pwgen -s.