A random password generator
Quote:
Originally posted here by ashbourn
the best passwords are random ones.
You may already have your own practical way of choosing good password manually. But you may also wonder how some sites can give you an initial random password when you sign up. I know, google can give me a bunch of links for password generator program, but I'm curious on how to do it. So I've been thinking about generating random password programatically, and here's what I came up with.
Have a look at the sample HTML page (I also attach it below).
http://members.fortunecity.com/jdenny/passgen.html
It demonstrates the use of my simple password generator program. You may think why on earth I wrote the program in JavaScript. Well, it's because the only thing you need to try it is your very browser you're staring at. I've tested it using NS 4.7 and IE 5.5 on my W2K notebook (Yeah, both are pretty old browsers... but I'm kinda old guy as well :D). Just make sure your browser supports JavaScript version 1.3 and enable it. Sorry if the page looks ugly (it is), since I wrote it by hand with the good ol' Notepad!
To those who call themselves programmers, you can easily port it to C, C++, Java, or Perl, since they all have "similar" syntax, and perhaps insert it to your own application (Porting it to VB is a bit tough, but hey, don't you love a challenge?). I suggest not to use the sample page in a production server though, since being a client-side JavaScript application, anybody can see the source code and could exploit it.
All passwords generated by this program should contain
- mixed case, all uppercase, or all lowercase letters
- at least two numbers or special characters
- a letter in the first and last position
I admit that some generated passwords might not as secure as you want. It depends on the quality of the random number generator. I use the JavaScript's Math.random() function to generate random numbers. I'm not sure who will eventually generate them: the JavaScript interpreter, the browser, the operating system, or the hardware. Anyone knows? Anyway, if you use the sample page interactively to generate passwords, you can press the [Generate] button as many as you want until you're tired, I mean, satisfied with the result.
It does include user-selectable special characters like ~!@#$%^&*_. Note that some security experts discourage it as (1) people find them hard to remember, (2) it may break many things (someone set his CMVC password to 'abc|def', then received an error saying "Unable to execute def!"), also (3) it could be a problem if you switch among different national keyboards. Personally, I think it's good to have carefully-selected special characters in a password.
The program is totally free for anybody to use, modify, or distribute, as a whole or partially, without any warranty or support. I added some comments for learning purposes (who says programming ain't fun?). Ummm... oh, any comments are welcome!
Peace always,
<jdenny>
