Depending on the type of characters you may include, an easy command to create a readable password with 128 bits of entropy looks like this:
< /dev/urandom tr -dc [:graph:] | head -c20; echo;
(Taken from here).
[:graph:] are all ascii pritable characters except space.
128 bits are equivalent to 3.40e+38 combinations. If you're using the 94 readable ascii characters (except space), you'd need 20 characters to reach at least that amount of combinations: 94^20 = 2.90e+39.
If, for example, you're only allowed to use
< /dev/urandom tr -dc '_A-Za-z0-9' | head -c22; echo;
For 63 possible characters: 63^22 = 3.85e+39. It only adds two characters to reach full entropy.
For hexadecimal passwords:
< /dev/urandom tr -dc 'A-F0-9' | head -c32; echo;
Hexadecimal is easy: 128 bits are 32 times the bits of a hexadecimal character.
Important notice: Most of the situations where you need a password, you'll be using a hash function behind, which will actually derive the real string which will be used. This analysis is subject to the way the password is hashed/used.
/dev/urandom is secure for this operation. Please check Is a rand from /dev/urandom secure for a login key?.
Additional note: If you're using more than one iteration with a hash function, you can substract the bits needed to express the iteration of the total amounts of bits you can to reach, e.g.:
65536 iterations = 2^16 iterations, add roughly 16 bits (2 bytes) of entropy to the choosen password, because in a brute force attack, you need to perform 2^16 additional iterations before calculating the used hash.
Just for the record, going beyond 128 bits of entropy, is unnecerary as explained here: Amount of simple operations that is safely out of reach for all humanity?
But if your paranoia goes beyond that, here are some useful numbers:
All ascii readable (29 characters, 1.6e+57 combinations), 192 bits (6.28e+57 combinations) of entropy:
< /dev/urandom tr -dc [:graph:] | head -c29; echo;
_A-Za-z0-9 (32 characters, 3.79e+57 combinations), 192 bits (6.28e+57 combinations) of entropy:
< /dev/urandom tr -dc '_A-Za-z0-9' | head -c32; echo;
A-F0-9 (48 characters, 16^48 combinations), 192 bits (2^192 combinations) of entropy:
< /dev/urandom tr -dc 'A-F0-9' | head -c48; echo;
All ascii readable (39 characters, 8.95e+76 combinations), 256 bits (1.16e+77 combinations) of entropy:
< /dev/urandom tr -dc [:graph:] | head -c39; echo;
_A-Za-z0-9 (43 characters, 2.35e+77 combinations), 256 bits (1.16e+77 combinations) of entropy:
< /dev/urandom tr -dc '_A-Za-z0-9' | head -c43; echo;
A-F0-9 (64 characters, 16^64 combinations), 256 bits (2^256 combinations) of entropy:
< /dev/urandom tr -dc 'A-F0-9' | head -c64; echo;
Considering the last six options are already paranoid, it's completely pointless choosing complexer or larger passwords than the ones described above.
head -16 /dev/urandom | openssl sha1