For developers who prefer the command line, Bitwarden offers a powerful CLI tool that lets you manage passwords, generate new credentials, and sync your vault — all from the terminal.
For developers and system administrators, the command line is home turf. While graphical password managers have their place, generating strong, random passwords directly from the terminal is faster, scriptable, and entirely transparent. Linux ships with a remarkable array of tools capable of producing cryptographically sound secrets without ever touching a browser or a third-party service. Understanding these tools means you can integrate password generation into deployment scripts, provisioning workflows, and automated infrastructure with confidence. This guide explores the most reliable methods, the security considerations behind them, and the practical idioms that experienced engineers reach for daily.
The terminal offers something graphical tools rarely match: composability. A password generated on the command line can be piped directly into a configuration file, stored in an environment variable, hashed on the spot, or fed into a secrets manager. There is no copy-paste step where a credential might linger in a clipboard history or be captured by a malicious extension. For automation, this matters enormously. When you are spinning up a hundred ephemeral containers or rotating database credentials nightly, you need generation that runs unattended and produces output you can manipulate programmatically.
There is also the question of trust. Online password generators ask you to believe that the secret never leaves your browser, that no logging occurs, and that the randomness is genuine. On your own machine, drawing from the kernel's entropy pool, you can verify exactly what is happening. The source is open, the randomness is auditable, and nothing crosses the network.
The foundation of any good password is true randomness, and on Linux that comes from /dev/urandom. This special file provides a stream of cryptographically secure pseudorandom bytes seeded by the kernel's entropy pool. Unlike the older /dev/random, it does not block waiting for entropy, and for password generation purposes it is considered entirely secure on any modern system. The trick is converting raw bytes into printable characters.
tr -dc 'A-Za-z0-9' < /dev/urandom | head -c 20 produces a twenty-character alphanumeric string. The -dc flag deletes everything not in the specified set.tr -dc 'A-Za-z0-9!@#$%^&*' < /dev/urandom | head -c 24. Be cautious with shell-special characters, which can complicate later use.base64 is a quick way to get a printable, high-entropy string: head -c 18 /dev/urandom | base64. Each three bytes becomes four printable characters.If your system has OpenSSL installed, and nearly every Linux box does, you have an excellent password generator at your fingertips. The openssl rand command draws from a cryptographically secure source and formats the output for you. The command openssl rand -base64 24 yields a thirty-two-character base64 string with roughly 192 bits of entropy, far more than any password needs. For hexadecimal output, openssl rand -hex 16 gives a thirty-two-character hex string.
OpenSSL's appeal lies in its ubiquity and its battle-tested randomness. Because it is already part of nearly every server's software stack, scripts relying on it rarely break across environments. The base64 alphabet includes + and / characters, which occasionally cause trouble in URLs or certain configuration formats, so some developers post-process the output with tr to strip or substitute those symbols.
Sometimes you want a tool built specifically for the job. Two long-standing utilities fill this role, both installable through standard package managers.
pwgen 16 1 generates one sixteen-character password. By default it produces pronounceable strings; the -s flag switches to fully random, and -y adds symbols. Running pwgen -sy 20 1 produces a strong, symbol-laden secret.These tools are convenient, but be aware that pronounceable passwords trade some entropy for memorability. When generating credentials for machines rather than humans, prefer the fully random modes.
Long random strings are ideal for service accounts, but humans still need passwords they can occasionally type. Diceware-style passphrases, built from random words, offer high entropy with better usability. You can build one from the command line by selecting random words from a wordlist. A command like shuf -n 4 /usr/share/dict/words | tr '\n' '-' picks four random words and joins them with hyphens, producing something like copper-lantern-drifting-mosaic.
The shuf utility is worth knowing well. It performs a uniform random shuffle and draws its randomness from a secure source, making it suitable for cryptographic selection. Combined with a large wordlist, four or five words yield entropy comparable to a strong random string while remaining far easier to transcribe.
Because these commands are short, developers often wrap them in shell functions stored in their .bashrc or .zshrc. A simple function such as genpass() { openssl rand -base64 "${1:-24}" | tr -d '\n'; echo; } lets you type genpass 32 to produce a password of arbitrary length. Wrapping generation this way standardizes your approach across projects and reduces the temptation to reach for weaker shortcuts.
Not all randomness is equal. Avoid generating passwords with tools that rely on weak sources such as the shell's $RANDOM variable, which is not cryptographically secure and should never produce credentials. Stick to /dev/urandom, OpenSSL, or purpose-built utilities that draw from the kernel pool. Length matters more than complexity; a longer password from a smaller alphabet often beats a short one packed with symbols.
Consider where the password travels after generation. Piping directly into a secrets manager or hashing utility keeps the plaintext out of files and terminal scrollback. When passwords must be stored, hash them immediately with a tool designed for the purpose rather than leaving them in plain configuration. Finally, audit your scripts: a generation routine that silently truncates output or falls back to a weak source can undermine an otherwise solid security posture.
The Linux command line provides everything a developer needs to generate strong passwords without external dependencies. Whether you reach for a one-line openssl rand invocation, a filtered stream from /dev/urandom, or a dedicated tool like pwgen, the building blocks are fast, transparent, and endlessly scriptable. By understanding the entropy sources behind these commands and wrapping them in sensible functions, you gain credential generation that fits naturally into automated workflows and stands up to scrutiny.
Store passwords with NordPass.