Random password generator on Ubuntu

Below are four commands that work, what each one gives you, and how strong the result is.

1. openssl rand (installed by default)

openssl rand -base64 24

openssl rand prints random bytes from a cryptographically secure generator, and -base64 turns them into printable text. 24 bytes is 24 × 8 = 192 bits, which becomes 32 characters of letters, digits and the symbols + and /. Pick the number of bytes for the strength you want: 16 bytes (128 bits) gives 24 characters, including two = at the end that add no strength.

The manual says the command fails with an error rather than printing weak output if it can't seed itself from the operating system.

2. /dev/urandom with tr (letters and digits only)

LC_ALL=C tr -dc 'A-Za-z0-9' < /dev/urandom | head -c 20; echo

This reads the kernel's random source, keeps only the characters you list after -dc and stops after 20. With 62 possible characters, each one is worth log2(62) ≈ 5.95 bits, so 20 characters give about 119 bits. Change the list to change the alphabet, for example 'A-Za-z0-9!@#%+=' to add a few symbols, and change 20 for the length. LC_ALL=C stops tr tripping over bytes that aren't valid text in your locale.

3. pwgen -s (one small package)

sudo apt install pwgen
pwgen -s 20 1

pwgen is in Ubuntu's universe repository. The arguments are the length and the number of passwords. Always add -s: by default pwgen makes pronounceable passwords, and its manual warns they shouldn't be used where they could face an offline brute-force attack. -y adds at least one symbol, -B leaves out characters that are easy to confuse, such as l and 1 or 0 and O, and -1 prints one password per line.

pwgen's manual doesn't spell out the exact alphabet, so we haven't given a bit count for it here. At 20 characters from letters and digits it's comfortably strong.

4. Python's secrets module

python3 -c "import secrets; print(secrets.token_urlsafe(24))"

Python 3 comes with Ubuntu, and its secrets module is built for passwords and tokens. token_urlsafe(24) takes 24 random bytes (192 bits) and prints them as 32 URL-safe characters: letters, digits, - and _. Python's documentation says 32 bytes (256 bits) is enough for the module's typical uses.

Which command to use

• For a password you'll paste: openssl rand -base64 24. It's already there and it's strong.
• When a site only accepts letters and digits: the tr command, with the alphabet you need.
• For many at once in a script: pwgen -s 20 10 prints ten.
• In your own Python code: the secrets module, never random.

All four commands ran as shown on Ubuntu 24.04 when we checked them in November 2026, except pwgen, which we checked against its manual.

Without the terminal

If you'd rather use a browser, the generator below runs on your computer as well: it uses your browser's cryptographic random source, and nothing is sent anywhere. It starts on 20 letters and digits with no symbols, like the tr command. Tick Symbols for more strength per character, or switch to words for a passphrase you can remember.

Keep it safe once it's made

A command prints the password to your screen, and some terminals keep scrollback. Copy the password into your password manager straight away, then clear the screen with clear. Don't put a real password on the command line as an argument to another program, because commands are saved in ~/.bash_history.

NIST asks for at least 15 characters for a password used on its own, and every command above clears that. Use a different password for each account; for the reasons and the rest of the advice, see secure password tips.