Occasionally I need to generate a password while working at the Unix command line. I have the following alias in my zshrc:

alias randpass='openssl rand -base64 32 | tr -d /=+ | cut -c -30'

These commands generate a string of 30 alphanumeric characters by doing the following things:

  1. Use OpenSSL to generate 32 bytes of random data.
  2. Base64-encode the result.
  3. Remove all characters except for uppercase letters, lowercase letters, and digits.
  4. Truncate the result to 30 characters.

The only flaw I can see is that there may be fewer than 30 characters left after removing instances of /, =, and +. Of course, that would require these three symbols to make up over a third of the base64-encoded characters, which is phenomenally unlikely.

Is the output of “openssl rand” sufficiently random to use as the basis of passwords? Is there any kind of bias introduced by base64-encoding the random bytes? (I assume that removing /, =, and + introduces a bias but that this is pretty minimal.)


You could increase the number of bytes to 45. Then you are guaranteed not to get the value truncated to lower than 30 bytes because then at least a half (30 characters) would need to be /, = or + to render a string shorter than 30 characters.

Yes its sufficiently random.

No bias is introduced by Base64-encoding the characters, since you just convert them to a Another base format. Its still the exact same number. The only small bias introduced is removing the /, and +, which would correspond to removing every occurrence of 111110 and 111111 in the string, you would basically only lose 2 bits of entropy over a string that is 180 bits long, it would reduce the random to 178 bits, which is still much better than a SHA1 string (that many passwords is stored as), MD5 or AES 128 key.

The character = is only padding and does not have any meaningful value in a base64 string.

  • many sites require symbols so output of base64 is too limiting – Scott Stensland Sep 6 '16 at 22:21
  • @ScottStensland Then you can keep /, + or = in the Base64 string. I have found many sites who FORBID anything else than A-Za-z0-9 and a few special characters, and thats why I suggest filtering out /, = and +. – sebastian nielsen Sep 7 '16 at 1:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.