I'm using the command line tool pwgen to generate passwords because I love the repeatability you get with the sha1 command line flag. To quote the man page:

   -H, --sha1=/path/to/file[#seed]
          Will  use the sha1's hash of given file and the optional seed to
          create password. It will allow you to compute the same  password
          later, if you remember the file, seed, and pwgen's options used.
          ie: pwgen -H ~/your_favorite.mp3#[email protected] gives a list  of
          possibles  passwords for your pop3 account, and you can ask this
          list again and again.

          WARNING: The passwords generated using this option are not  very
          random.   If you use this option, make sure the attacker can not
          obtain a copy of the file.  Also, note that the name of the file
          may  be  easily available from the ~/.history or ~/.bash_history

I'm using it to generate (and retrieve) passwords like this:

pwgen -1cnsy --sha1=/path/to/my/gpg/private-key.asc#[email protected]

The only problem is that I can't figure out a way to specify how many characters I want the password to be. By default it generates an 8-character password, which is more susceptible to brute-forcing.

Alternatively, I could use apg, which allows me to specify the number of characters, but I don't see a way to make apg take a file and string as a seed to give me repeatable characters.

Is there a way I can make pwgen generate passwords of a specified length?

  • Using your private keys like that puts them at risk. Better use some random file that won't change (like the MP3 they mention). Or just use this advise (not literally!).
    – vonbrand
    Commented Mar 9, 2013 at 15:55
  • How does using my private key like this put it at risk? The crypto isn't reversible, right?
    – Kerrick
    Commented Mar 9, 2013 at 21:38
  • It is being read by a program that might be subverted. The risk is minimal, but why risk it...
    – vonbrand
    Commented Mar 9, 2013 at 21:47

1 Answer 1


Usage: pwgen [ OPTIONS ] [ pw_length ] [ num_pw ]


pwgen -1cnsy --sha1=/path/to/my/gpg/private-key.asc#[email protected] 42

Beware that pwgen will happily print a password that's as long as you request, but beyond a certain point (determined by the entropy of the specified file) that doesn't increase security.

  • 2
    I... I need to stop skimming the Usage examples at the top of man pages. I combed through the rest of the man page carefully. Thanks!
    – Kerrick
    Commented Mar 9, 2013 at 2:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .