Occasionally I need to generate a password while working at the Unix command line. I have the following alias in my zshrc:
alias randpass='openssl rand -base64 32 | tr -d /=+ | cut -c -30'
These commands generate a string of 30 alphanumeric characters by doing the following things:
- Use OpenSSL to generate 32 bytes of random data.
- Base64-encode the result.
- Remove all characters except for uppercase letters, lowercase letters, and digits.
- Truncate the result to 30 characters.
The only flaw I can see is that there may be fewer than 30 characters left after removing instances of
+. Of course, that would require these three symbols to make up over a third of the base64-encoded characters, which is phenomenally unlikely.
Is the output of “openssl rand” sufficiently random to use as the basis of passwords? Is there any kind of bias introduced by base64-encoding the random bytes? (I assume that removing
+ introduces a bias but that this is pretty minimal.)