Generate a Password on Linux

openssl rand -base64 18

Before you generate anything

A secure random command solves only the generation step. Terminal scrollback, session recording, clipboard history, screen sharing, and careless storage can still expose the result.

• Run password-generation commands on a trusted machine, not a shared shell, monitored jump host, CI log, or recorded support session.
• Do not paste a generated password into a command as an argument. Command arguments may be visible to other processes and diagnostic tools.
• Do not place the password in a shell script, dotfile, unencrypted note, ticket, or chat message.
• Prefer saving it directly into a trusted password manager. If you use the clipboard, keep the exposure brief and consider clipboard-history software.
• Use a different password for every account.

Option 1: OpenSSL rand

OpenSSL documents openssl rand as a command that generates bytes with a cryptographically secure pseudorandom number generator. The number at the end is a byte count—not the final number of text characters.

Base64: compact output with symbols

openssl rand -base64 18

Eighteen random bytes contain 144 random bits and encode to 24 Base64 characters without padding. Base64 can contain uppercase and lowercase letters, digits, +, and /. Use the hexadecimal option when the destination rejects those symbols.

Hexadecimal: broadly compatible output

openssl rand -hex 16

Each random byte becomes two hexadecimal characters, so this command prints 32 characters backed by 128 random bits. Hex uses only 0–9 and a–f; its longer output compensates for the smaller alphabet.

Option 2: Python’s secrets module

Python’s secrets module is designed for passwords, authentication tokens, and other secrets. Python explicitly recommends it instead of the general-purpose random module, which is intended for simulation rather than cryptography.

python3 -c 'import secrets, string; alphabet = string.ascii_letters + string.digits; print("".join(secrets.choice(alphabet) for _ in range(24)))'

This selects each character independently from 62 uppercase, lowercase, and numeric choices. It is useful when a legacy form rejects punctuation. Do not replace secrets.choice with random.choice.

Option 3: Read from /dev/urandom

Modern Linux exposes the kernel’s cryptographically secure random-number generator through /dev/urandom. The Linux man-pages project describes it as preferred and sufficient for normal use after the system’s entropy pool has initialized. Higher-level tools such as OpenSSL or Python are usually easier to use correctly.

od -An -N16 -tx1 /dev/urandom | tr -d ' \n'; printf '\n'

od reads exactly 16 bytes and prints hexadecimal; tr removes spaces and the embedded newline before a final newline is printed for a clean prompt. This transformation preserves every random bit. Avoid improvised pipelines that map bytes with an uneven remainder, because they can favor some output characters.

Choose the right output format

• Base64: compact and efficient, but + and / may violate a site’s rules.
• Hex: highly compatible and easy to move between tools, but it needs more characters for the same random-bit count.
• Alphanumeric: useful for restrictive systems; use independent secure selection rather than deleting characters from an already generated value by hand.
• Random words: better when a human must type or remember the credential. Use the passphrase generator or Diceware generator.

Shell history: what is and is not recorded

Bash records the command text in its history list before parameter and variable expansion. The examples above therefore record the generator command, not the random text printed afterward. That does not make the terminal output private: scrollback buffers, shell-session recorders, remote administration logs, screen sharing, and copied text may retain it.

Avoid typing the password back into a later command. Also avoid assigning it to an exported environment variable or placing it on a process command line. Disabling history for one command does not address terminal output, audit tooling, or other shells, and settings such as HISTCONTROL=ignorespace are Bash-specific rather than a complete secret-handling strategy.

Clipboard and storage risks

Commands that pipe a password directly to xclip, xsel, or wl-copy are convenient, but the clipboard can be read by other software and retained by clipboard managers. This guide does not automatically copy output for that reason. If you choose to copy a password, do it immediately before entering it, verify the destination, and clear or replace the clipboard afterward when your desktop environment does not do so automatically.

The safest destination is normally a trusted password manager entry associated with the exact site and username. Enable multifactor authentication or a passkey when available. Read the broader strong-password guide for account-level guidance.

No terminal available?

Use the browser password generator. It uses the browser’s Web Crypto API, runs locally on your device, supports compatibility presets and character exclusions, and does not place generated values in the page URL or browser storage.

Sources and tested scope

The commands were reviewed against current upstream documentation and executed locally on September 24, 2026. Package availability and command versions vary by distribution.

• OpenSSL: openssl-rand documentation
• Python: secrets — Generate secure random numbers for managing secrets
• Linux man-pages: random and urandom devices
• GNU Bash: History Facilities