Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I wonder how I can create strong passwords on Linux (for both normal and admin users) and if there are specific programs to do that.

share|improve this question

10 Answers 10

Personally, I prefer not to use password generator as password generated are very hard to remember, but one portable solution is to use /dev/urandom

Creating random passwords which contains no special characters, is 10 characters long:

$ cat /dev/urandom | tr -dc 'a-zA-Z0-9' | head -c 10` 

This works by grabbing bytes from /dev/urandom, deleting the ones that don't fit the pattern specified in the tr command, and limiting it to 10 characters with head.

Creating random passwords which contains special characters, is 10 characters long:

$ cat /dev/urandom | tr -dc 'a-zA-Z0-9-_!@#$%^&*()_+{}|:<>?=' | fold -w 10 | grep -i '[!@#$%^&*()_+{}|:<>?=]' | head -n 1

This uses a slightly different technique after tr removes unwanted bytes, as the idea is to force it to have at least one special character. This works by using the fold command to wrap the line into groups of 10, then using grep to fetch only lines that contain a special character. head then fetches the first password that meets the requirements.

share|improve this answer
You can also use [:print:] for tr (tr -dc '[:print:]'), if you are a bit paranoid. The problem then will be the symbols available on your keyboard... –  lgeorget May 5 '13 at 15:32

Here's a one-off script for generating XKCD-style passphrases. /usr/share/dict/words isn't a great dictionary for this since most of the words are long, but it is easily available. For nicer passphrases you could use a dictionary of short words such as the S/Key One-Time Password word list.

max="`wc -l <"$dict"`" \
    perl -e '$count=4;
        $/=\4; while (<>) {
            print unpack('L') % $ENV{max} + 1, qq(\n); last unless --$count
        }' /dev/urandom | 
    while read n ; do 
        tail -n "+$n" "$dict" | head -1
share|improve this answer

Correct me if I'm wrong, but: As far as I understood it, there is no way a computer can come up with a completely random string. So I came up with the following idea [and hope it isn't completely stupid]:

If one throws a 26-sided dice, the chance to throw, say 26 is 1:26. In other words: The chance to throw 26 is about 0.04%. Further, a dice has no memory and no bugs. I came up with the following idea:

  • get a 26 sided dice, where each side matches a letter of the alphabet
  • get a ten sided dice where each side matches a number between 0 and 9
  • flip a coin
  • head means: throw letter dice
  • tails means: throw number dice

Paper Models to print out:

Note: I'm not a Math Pro and I came up with this idea after reading an article in 2600 magazine which described this. I just added some of my own ideas on the basic concept.

Also: I wonder if this isn't just a perfect example for 'write your first brute force password cracker'. But your question gave me a perfect reason to bring forth this idea for being discussed.

share|improve this answer
There actually are some ways to generate completely random bits. For example using the electromagnetic noise from your HDD or the variation of IO rates... What is hoped with the generators called 'pseudorandom generators' is that the sequence they output can't be distinguished from a true random sequence by any algorithm running in polynomial time. –  lgeorget May 5 '13 at 15:38
You may be interested in the Diceware system. It follows a similar idea, but uses only six-sided dice. world.std.com/~reinhold/diceware.html –  Jander Jan 29 at 18:00

pwgen is a wonderful little cli tool that let's you specify a number of parameters to set complexity, character classes number of passwords to generate, length, etc.

share|improve this answer

If you are a GNOME user and you also need to store passwords for your various accounts you can try the Revelation password manager. It has a basic password generator feature, in that you only set the password length and choose if to include punctuation characters besides letters and digits.

share|improve this answer

apg is not a bad choice if you want password that can be easily remembered.

$ apg

Please enter some random data (only first 16 are significant)
(eg. your old password):>
Biecdyphlaj7 (Biec-dy-phlaj-SEVEN)
UcJekIp1 (Uc-Jek-Ip-ONE)
shokDocVed5 (shok-Doc-Ved-FIVE)
at0ocAwch (at-ZERO-oc-Awch)
Oc8ofyink (Oc-EIGHT-of-yink)
yacbidIlt8 (yac-bid-Ilt-EIGHT)
share|improve this answer

I'd also add KeePassX which gives you the option of using system entropy to generate strong passwords with a few nice features - all using GUI. It also gives you the option of managing your passwords, and saving them to an encrypted file.

This is how KPX password generator interface looks like:

enter image description here

share|improve this answer

I use a non random, but is varied enough for all attack purposes... master password, and last pass to generate other passwords. Here's how I generate the master password.

echo -n "some seed" |  openssl dgst -binary -sha1 | base64 | sed -e 's/.\{4\}/& /g'

and the output

H1sI Wpbj JE2P CdVJ A1qb 9B/e u7M= 

now just pick a few of the sections and make a password, rearrange them, leave some out, add a character or 2 to make it as good as random. As long as you can remember your seed you can regenerate this, and recover your password (so long as you don't make too many modifications)

share|improve this answer

I wrote this little script a few years ago and have been using it ever since. If anything, it's an interesting abuse of printf and uses a lovely feature of BASH that I unfortunately rarely see in scripts: typeset.

#!/usr/bin/env bash
# Released into public domain
# Aaron Bockover, 2005
# http://abock.org

typeset -i length; length=$1
typeset -i rounds; rounds=$2
[ $rounds -lt 1 ] && rounds=1
[ $length -lt 1 ] && {
    echo "Usage: $0 <length> [<rounds>]" 2>/dev/null; exit 1;
for ((i=0; i < $rounds; i++)); do
    for ((j=0; j < $length; j++)); do
        set=$(($RANDOM % 20))
        if   [ $set -le 6 ];  then o=65; l=26; # 35% uppercase
        elif [ $set -le 13 ]; then o=97; l=26; # 35% lowercase
        elif [ $set -le 17 ]; then o=48; l=10; # 20% numeric
        elif [ $set -le 18 ]; then o=58; l=7;  # 10% symbolic
        elif [ $set -le 19 ]; then o=33; l=15; fi
        ord=$(($o + $RANDOM % $l))
        printf \\$(($ord / 64 * 100 + $ord % 64 / 8 * 10 + $ord % 8))
share|improve this answer
Thanx for the script Aaron!!! –  Gasuma Aug 20 '10 at 18:17

pwgen is one of many programs for generating passwords

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.