How to Generate Secure Random Passwords in Linux Terminal Using pwgen

While standard command-line tools like openssl rand or reading from /dev/urandom can produce random strings of characters, they often output unpronounceable strings that are cumbersome for human operators to transcribe without copying and pasting. The pwgen utility is a dedicated password generator designed specifically for Linux environments. It creates passwords that are either intentionally designed to be easily memorised by humans while remaining resistant to dictionary attacks, or completely random, high-entropy strings reinforced with symbols and numbers for server secrets and database credentials.

Installing pwgen on Linux Distributions

Because pwgen is a lightweight standalone binary, it is available across the standard package repositories of all major Linux distributions:

• Ubuntu, Debian, and Linux Mint:
  sudo apt update && sudo apt install -y pwgen
• RHEL, CentOS, AlmaLinux, and Rocky Linux:
  sudo dnf install -y epel-release && sudo dnf install -y pwgen
• Fedora:
  sudo dnf install -y pwgen
• Arch Linux and Manjaro:
  sudo pacman -S pwgen

Basic Usage: Generating Memorable Passwords

When executed without options, pwgen fills your terminal window with a grid of phonetically pronounceable, 8-character passwords containing lowercase letters, capital letters, and numbers:

pwgen

To control the length of the generated password and the quantity of candidates produced, pass two numerical arguments representing length and count. For example, to generate five 16-character passwords:

pwgen 16 5

To produce exactly one password formatted on a single clean line (ideal for piping into scripts, clipboard managers, or environment variables), add the -1 option:

pwgen 20 1 -1

Creating Cryptographically Strong, Completely Random Passwords

Phonetically pronounceable passwords are convenient for end users, but mission-critical service accounts, API keys, and database passwords demand maximum entropy. You can use the -s (secure) and -y (symbols) flags to enforce complete mathematical randomness:

pwgen -s -y 24 1

This command instructs pwgen to:

• -s (Secure): Generate completely random, unpronounceable passwords rather than phonetic syllables.
• -y (Symbols): Include at least one special punctuation mark or symbol (such as !@#$%^&*()).
• 24: Set password length to 24 characters.
• 1: Print exactly one candidate.

Essential Command-Line Options in pwgen

You can combine various flags in pwgen to tailor password generation to specific corporate password complexity requirements:

• -c (Capitalise): Guarantee at least one uppercase letter in the password.
• -A (No Capitals): Exclude capital letters entirely.
• -n (Numerals): Include at least one numerical digit (default behaviour).
• -0 (No Numerals): Exclude numbers entirely.
• -B (Ambiguous): Exclude visually ambiguous characters that look similar on screen, such as 1 and l, or 0 and O. This flag is especially valuable when writing passwords onto temporary physical cards or relaying credentials over audio channels.
• -r <chars>: Remove specific troublesome characters that might interfere with shell scripts or SQL syntax (e.g. pwgen -s -y -r \'\"\\ 16 1).

Automating Password Generation in Bash Scripts

Because pwgen operates cleanly on standard output, you can easily integrate it into automated user onboarding scripts, Dockerfile initialization routines, or Ansible playbooks:

NEW_USER_PASS=$(pwgen -s -B 16 1)
echo "Generated secure password: $NEW_USER_PASS"

By coupling the secure (-s) and non-ambiguous (-B) switches, you ensure that automated systems receive cryptographically resilient credentials that administrative staff can read and verify without visual errors.