Password Generator Script

Python’s random module is a Mersenne Twister (by default) seeded in a way that is convenient for simulations. If an attacker can observe enough outputs, or guess the seed (clock, PID, a small space), they can predict future outputs. That is acceptable for a dice roll in a game. It is not acceptable for a password. secrets is the standard library’s answer: secrets.choice(seq) returns a uniformly chosen element using a cryptographically strong RNG. secrets.token_hex, secrets.token_urlsafe, and secrets.token_bytes exist for tokens. For a password you can type or paste, the usual pattern is: build an alphabet, call secrets.choice once per character, join. You do not import random for this file. You do not “seed with time.time() to make it extra random” — that is how people shrink the search space. You do not use random.random() < 0.5 to decide whether to include a digit. That is a toy coin.

A common confusion: “but my random.choice passwords look messy.” Looking messy is not entropy. A password of eight lowercase letters chosen with a predictable RNG can look messy and still be in a space a GPU eats. Another confusion: “I will add secrets later; random is fine for the prototype.” Prototypes get copied. The module name in the import line is the control. If the file generates secrets for accounts, the import is secrets. If the file shuffles a list of lab hostnames you invented, random is fine. Do not mix them in gen_password.py. Do not pull in a third-party “advanced RNG” from a random PyPI package to look serious — extra dependencies are extra supply chain, and the standard library already solved this.

Strength is roughly alphabet_size ** length, assuming independent uniform picks. string.ascii_letters gives 52 characters, digits add 10, a small symbol set like !@#$%^&* adds a handful more. Twenty characters from that mix is a different universe from eight characters from lowercase-only, and a different universe from Password1!. Clever phrases that hit song lyrics, pet names, and keyboard walks fail because attackers do not brute-force first — they try corpora. Your generator’s job is to skip clever. Length 20 is a teaching default, not a religion: some systems cap length; some reject certain symbols. If a site forbids ^, shrink the symbol set, do not secretly fall back to iloveyou. Unique per account: one generated string for mail, a different one for the lab VPN. Reuse is how one breach opens three services.

Do not “ensure complexity” by forcing the first character to be uppercase and the last to be a bang after a predictable template. That shrinks the space again. If a policy requires at least one digit and one symbol, draw the full string with secrets.choice, then reject-and-retry until the policy holds — still using secrets — rather than slotting known characters into known positions. Do not print entropy estimates from a blog formula as if they were a guarantee. Do not generate 10,000 candidates and pick the “most random looking” by eye. The first output of a correct generator is the password. You paste it into the manager and you close the terminal scrollback when you can. You do not screenshot it into a group chat.

The script’s output is a secret the moment it exists. print(password) to your own terminal is the intended path: you copy it into a password manager, then you do not save the script’s stdout. Do not open a log file and write the password. Do not email it to a ticket system “for the record.” Do not commit gen_password.py after you edited it to contain password = "the one I just generated". Do not name the file my_bank_password.py. Do not leave the output in a world-readable lab notes file. If you must keep a recovery copy for a throwaway lab account, that copy lives in a chmod 600 file that is in .gitignore — and even then, a manager is better. Module 4 will repeat chmod 600 and .gitignore for API keys. Same instinct: secrets are not source.

The generator is not a cracker. It does not take a hash. It does not take a login URL. It does not loop until a site returns 200 OK. Those extra loops are how people turn a teaching script into Hydra. You will not add requests to this file to “verify the password works.” You will not point it at localhost SSH either, unless you are testing YOUR lab account with a password you just set through the normal passwd path — and even that is unnecessary for this lesson. Success is: a 20-character string appears, you store it in the manager for an account you own, the script contains no leftover secret, git status is clean of passwords. Failure is a gist titled passwords.txt.

Write the generator under $HOME/cyberlium-lab. Run it. Copy the output into a manager (or a throwaway lab login you own). Then write notes that record the module, alphabet idea, and length — not the password. chmod 600 the notes. If you accidentally printed into a file, delete that file and rotate the password as if it leaked. Do not add argparse that takes a target host. Do not import requests. The stub below is the whole program plus a notes template. Fill the notes in your own words after you run it.

mkdir -p "$HOME/cyberlium-lab"
cd "$HOME/cyberlium-lab"

cat > gen_password.py << 'PY'
import secrets
import string

# Cryptographically strong picks — not random.random / random.choice.
alphabet = string.ascii_letters + string.digits + "!@#$%^&*"
length = 20
password = "".join(secrets.choice(alphabet) for _ in range(length))

# Print ONCE to the terminal. Do not write this to a log.
print(password)
PY

python3 gen_password.py

Copy the line into YOUR password manager, then continue.

NOTES="$HOME/cyberlium-lab/password-gen-notes.txt"
{
  echo "=== PASSWORD GENERATOR NOTES (no secrets in this file) ==="
  echo "module: secrets  (NOT random.random / random.choice)"
  echo "primitive: secrets.choice(alphabet) once per character"
  echo "alphabet: ascii_letters + digits + !@#$%^&*"
  echo "length: 20"
  echo "output_handling: printed once, pasted into my manager, not committed"
  echo "explicit_non_use: no Hydra, no live SSH/web login tests, no rainbow tables"
  echo "git: gen_password.py has no leftover password literals"
} > "$NOTES"

chmod 600 "$NOTES" gen_password.py

You now generate passwords with secrets, not with a game PRNG, and you treat the output as a secret: print once, manager, no git. Alphabet and length are the search space; clever phrases are not. The generator does not grow a login loop. Next — Log Parser Script — line-by-line reads of a fictional sample_auth.log YOU create, counting failures without scraping production or deanonymizing people.