A password generator inspired by https://xkcd.com/936/
Simply install the package with pip3 install makepass, then run the make_pass command:
$ make_pass CorrectHorseBatteryStaple7
The password is written to stdout, from which it can be captured via your pipelined capture mechanism of choice.
Makepass generates a memorable, readable password by combining N unique, random common english words, which are sourced from the Google Common English Words repository. By default, the list of 20,000 english words is used. The set of words is constrained to words between m and n characters long, inclusive, to promote memorability and prevent common words. A random numeral is appended, to satisfy the common requirement that passwords contain a letter and a number. The final password will be between L and M characters long; up to S passwords are generated internally until a password of appropriate length is found.
All of the above can be configured; run make_pass -h for a list of the flags that modify its behavior, as well as options for display of entropy information
All of the following parameters can be changed:
- N = 4
- m = 4
- n = 8
- L = 24
- M = ∞
- S = 10,000
- Random numeral is appended
- Random specical character is not appended
- Word set: 20k. Can be repaced with the 10k set.
- Special character set:
-_()/.,?!;:. Should be accepted by most password filters.
These default parameters produce passwords with an entropy of approximately 57.561 bits. Use the -v or -e flags to see a calculated entropy estimate given your parameters.
While I am confident in its basic soundness, makepass has not undergone any kind of security review or audit, and I am not an expert in the field of password security. Use at your own risk.
makepass is built around use of random.SystemRandom, which in turn is based on os.urandom. os.urandom is described by the Python documentation as "suitable for cryptographic use." For more information about the use of os.urandom and /dev/urandom in secure contexts, see this article.
The most obvious security hole I'm currently aware of in makepass is that it writes to stdout, which means that it writes your terminal if you run it without a pipeline or redirect, which may be logged or cached to disk. Make sure to pipe it into a secure destintion when creating a password you actually intend to use; I'm personally partial to the say command on OSX, which speaks the password out loud through your speakers.