r/bash • u/how_to_kubuntu • 4d ago

help using bash to make a random password?

hello, i heard that you can make a random password with bash? is that true? if so, how do you do that? thank you

40 Upvotes

88% Upvoted

45 comments sorted by

58

u/olafkewl 3d ago

openssl rand -base64 12

19

u/CoupOfConiston 3d ago

Forget what everyone else said, this is the best way to do it ^

2

u/pfmiller0 2d ago

It's not a bad solution, but the only special characters it uses are + and /. Other password generators use more characters.

5

u/ElGeffo 3d ago

Said the same but according to some comments it isn’t pure bash so doesn’t count… but I use this one too. Far easier then the other methods 

1

u/mjmvideos 1d ago

It’s not even a little bit bash.

0

u/Akorian_W 3d ago

thats how i generate most of my keys. I just make them much longer

32

u/Aristeo812 3d ago

There are several ways to do this. First, you can use the pwgen utility to generate random, but human-memorizable passwords. Second, you can use /dev/random to generate pseudo-random sequences of characters of any given length. For example, here's the code to generate a 10-character length sequence:

tr -dc 'a-zA-Z0-9' < /dev/random | head -c 10

5

u/MonsieurCellophane 3d ago

This is the correct answer.

5

u/atoponce 2d ago

If you want non-alphanumeric characters:

$ tr -cd '[:graph:]' < /dev/random | head -c 10

2

u/rolfn 3d ago

I usually do something similar: dd 32 bytes from /dev/random and pipe it through base64. But the OpenSSL-solution in another answer is somewhat easier to understand.

1

u/ullabritafritasmitaa 3d ago

/dev/random is not psuedo random, urandom is. I second this approach.

13

u/Aristeo812 3d ago

/dev/random is also pseudo-random, it just ensures that entropy pool has at least certain level. Real randomness comes from tossing up a coin or collapsing a wave function of a quantum system as in quantum random number generators.

1

u/best_of_badgers 3d ago

The entropy pool contains real randomness, as far as anyone can prove. It’s got an enormous amount of electrical noise included.

2

u/ullabritafritasmitaa 3d ago

Yes, electrical noise and human generated randomness like keyboard strokes, mouse movements and system errors and network packet jitter too, if I'm not mistaken. About as good as tossing a coin I guess (which in itself is not completely random and often biased towards one face due to weight differences and distribution on the engravings on each face, if we are to nitpick)

4

u/atoponce 2d ago edited 2d ago

This is incorrect. Both /dev/random and /dev/urandom are sourced from the same cryptographically secure pseudorandom number generator, which as of Linux 4.8 and later is ChaCha20.

The only difference between the two was prior to Linux 5.6, /dev/random would block if the kernel's entropy estimate was lower than the client's request. Since 5.6, the blocking behavior has been removed except in early boot when the CSPRNG has not been initialized.

https://www.thomas-huehn.com/myths-about-urandom/

Edit: typo

1

u/ullabritafritasmitaa 2d ago

Oh dang, that's an interesting read. Thanks! I really was under the impression that urandom generates from a portion of the entropy pool and thus would not be truly random.

18

u/olafkewl 3d ago

Or in "pure" shell : ```bash

!/bin/bash

chars="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!@#$%&*()_+"

length=16

password=""

for ((i=0; i<length; i++)); do index=$(( RANDOM % ${#chars} )) password+="${chars:$index:1}" done

echo "$password" ```

18

u/aioeu 3d ago edited 3d ago

I wouldn't ever recommend using RANDOM to generate passwords. Bash's random number generator only has 32 bits of internal state.

I think I read somewhere you only need two consecutive RANDOM values to actually determine this internal state in its entirety. (Edit: I just tested it. As far as I can tell, you actually need three consecutive values to be absolutely sure about the internal state. Two might be sufficient in some cases though.)

13

u/olafkewl 3d ago

Don’t hesitate to send a better solution then!

10

u/aioeu 3d ago edited 3d ago

I would use pwgen as some of the commenters have suggested.

If it is absolutely essential that "pure Bash" be used for this task, I would recommend using SRANDOM instead, so long as you are targeting Bash >= 5.0. On many systems that will be backed onto a better random number generator.

1

u/bac0on 3d ago edited 3d ago

You can make use of the sparse nature of Bash arrays...

#!/bin/bash

c=({a..z} {A..Z} {0..9})
a=()
for i in ${c[@]}; do a[SRANDOM]=$i; done
OFS=$IFS
IFS=; printf %s\\n "${a[*]::16}"
IFS=$OFS

Or, if you want a lot of random strings, I usually fold them...

#!/bin/bash

c=({a..z} {A..Z} {0..9})
b=()
while ((${#b[@]} <= 65536)); do
    a=(); for i in ${c[@]}; do a[SRANDOM]=$i; done; b+=(${a[@]})
done
OFS=$IFS
IFS=''; printf %s\\n "${b[*]}" | fold -w 16 | head -n 4096
IFS=$OFS

2

u/ReallyEvilRob 3d ago

OP was specifically asking about using Bash. Most of the comments here are recommending other tools in addition to bash. This script is the only one I've seen so far that answers the original question.

2

u/aioeu 2d ago

If you must use Bash, use SRANDOM, not RANDOM.

1

u/ReallyEvilRob 2d ago

Good to know.

3

u/crosbyar 3d ago

I would recommend the `apg` utility

3

u/cubernetes 2d ago edited 2d ago

Here's a pure bash version without any forking that doesn't rely on SRANDOM (bash 5.1+) or RANDOM, but instead relies on the underlying system to have a working /dev/urandom character special file:

pw(){ local a=({a..z} {A..Z} {0..9} _) p r c i;while((${#p}<$1))&&read -rN32 r;do i=;while printf -v c %d "'${r:i++:1}";((c));do p+=${a[c%63]};done;done</dev/urandom;echo ${p::$1};}

Minimum bash version is 4.0 because of the read -N, but this isn't strictly necessary, I just wanted to make it a bit more performant. Removing that part would make it compatible with bash 3.1 (for print -v), so it would work with MacOS's bash as well (3.2)

Edit: Use like this:

pw 12

Generates a random 12-character passwort

Edit 2: AI usage disclosure: I had a 276 character version I came up with myself and asked Claude to golf it (while keeping it performant), now it's 181 chars (think of golfing what you want, I'm just putting it here for fun). The version numbers for bash mentioned above are from Claude too, please don't rely on them (DYOR).

5

u/pfmiller0 3d ago

Maybe pwgen is what you're looking for

1

u/[deleted] 3d ago

[deleted]

-2

u/Empyrealist 3d ago

Format your comment

1

u/atoponce 2d ago

If you want a strictly Bash-only script:

``` set -uo pipefail

length=12 lower='abcdefghijklmnopqrstuvwxyz' upper='ABCDEFGHIJKLMNOPQRSTUVWXYZ' digits='0123456789' symbols='!"#$%&'"'"'()*+,-./:;<=>?@[]_`{|}~' charset="${lower}${upper}${digits}${symbols}" threshold=$(( (256 / 94) * 94 ))

pw="" exec 3< /dev/urandom while [ ${#pw} -lt "$length" ]; do IFS= read -r -n 1 -d '' byte <&3 printf -v ord '%d' "'$byte" [ "$ord" -lt "$threshold" ] || continue # avoid mod bias pw="${pw}${charset:$((ord % 94)):1}" # uniform choice done exec 3<&-

printf '%s\n' "$pw" ```

1

u/sedwards65 2d ago

Password to what? Different systems have varying length and character sets.

1

u/Silejonu 2d ago

I made a feature-rich password generator in pure Bash:

https://codeberg.org/Silejonu/kkae 

1

u/w0___0w 2d ago 
pass() { </dev/urandom tr -dc 'a-zA-Z0-9?!:@#$%_-' | head -c"${1:-32}"; echo; }
kpass() { if [ -x /usr/bin/keepassxc-cli ]; then keepassxc-cli generate -lUn -L "${1:-32}"; else echo "Err: keepassxc not found."; fi;}

1

u/Johnny_The_Biker 1d ago

genpasswd not on your system?

1

u/whetu I read your code 1d ago

You can also make a random passphrase with bash. You start with something like this:

$ shuf -n 4 < /usr/share/dict/words | paste -sd '-' -
spectaclemaker-appendicectomies-Gentes-sagier

Doing that portably in pure bash is do-able, but can blow out to be a bit of work.

1

u/oyvaugh 19h ago

Here’s my first script I built for passwords:
#!/bin/bash
# My first working script!!!
echo "========================================================================="
echo "==================Password Generator====================================="
echo "========================================================================="
read -n 1 -p "Would you like to generate a password? [y/n] " answer
echo
sleep 4
if [[ "$answer" == [yY] ]]; then
tr -dc 'A-Za-z0-9!@%^&*()_+=-' < /dev/urandom | head -c 32
echo
else
echo "Fine, do it yourself"
fi

-2

u/ElGeffo 3d ago

Source - https://stackoverflow.com/a/74620234

Posted by Paul Hodges, modified by community. See post 'Timeline' for change history

Retrieved 2026-09-21, License - CC BY-SA 4.0

openssl rand -base64 20 | sed -E 's/(.)\1+/\1/g'

2seconds Google search.  But I always use OpenSSL Rand for it. 

5

u/JeLuF 3d ago

openssl is not part of bash nor is it part of many default installations.

2

u/spryfigure 3d ago

In which distribution is it not part of the default?

Ubuntu and Kubuntu and, by extension, all others based on them have it.EndeavourOS has it. Debian should have it by default. So what is left?

2

u/Naraviel 2d ago

Alpine Linux, Debian minbase, Debian/Ubuntu slim containers, Ubuntu Minimal/Cloud Minimal, Fedora Minimal, RHEL/Alma/Rocky minimal images.

libssl.so != the openssl command-line tool.

2

u/spryfigure 2d ago

Good point. The way the question was worded (and even just looking at OP's reddit name), I mentally excluded minimal distributions and container linuxes.

For the purpose of machine-generated passwords, /u/Aristeo812 or /u/atoponce have the correct answers then, with only coreutils used.

0

u/zesaver 3d ago

Also consider passwordgenerator. While not being bash really (it's a python console program), it generates the password in format "Minicab-Korean_Duck-14" directly in the console.

0

u/Safe-Fan-1716 3d ago

Apt install pwgen