13

It's simple enough to generate a random string in Python (such as Python entropy shows). But are there any Python projects out there, which will generate password strings that are both somewhat pronounceable and readable? By readable, I mean not putting both zeros and O's in the same string, etc. I don't care if it's got maximum entropy, just something better than what I'm likely to pick. :)

2
  • 2
    BTW, you might find this relevant :)..
    – MAK
    Mar 31, 2011 at 17:53
  • @MAK, cute - it's sort of like building a second AI to chase down a rogue AI... :) (and coincidentally, the Fukushima nuclear reactor is all the news).
    – John C
    Mar 31, 2011 at 18:22

5 Answers 5

23

If you're really just looking for something "better than I can make up" and "pronounceable," then maybe just use random.sample() to pull from a list of consonant-vowel-consonant pseudosyllables:

import string
import itertools
import random

initial_consonants = (set(string.ascii_lowercase) - set('aeiou')
                      # remove those easily confused with others
                      - set('qxc')
                      # add some crunchy clusters
                      | set(['bl', 'br', 'cl', 'cr', 'dr', 'fl',
                             'fr', 'gl', 'gr', 'pl', 'pr', 'sk',
                             'sl', 'sm', 'sn', 'sp', 'st', 'str',
                             'sw', 'tr'])
                      )

final_consonants = (set(string.ascii_lowercase) - set('aeiou')
                    # confusable
                    - set('qxcsj')
                    # crunchy clusters
                    | set(['ct', 'ft', 'mp', 'nd', 'ng', 'nk', 'nt',
                           'pt', 'sk', 'sp', 'ss', 'st'])
                    )

vowels = 'aeiou' # we'll keep this simple

# each syllable is consonant-vowel-consonant "pronounceable"
syllables = map(''.join, itertools.product(initial_consonants, 
                                           vowels, 
                                           final_consonants))

# you could trow in number combinations, maybe capitalized versions... 

def gibberish(wordcount, wordlist=syllables):
    return ' '.join(random.sample(wordlist, wordcount))

Then you just choose a suitably large number of "words":

>>> len(syllables)
5320
>>> gibberish(4)
'nong fromp glosk zunt'
>>> gibberish(5)
'samp nuv fog blew grig'
>>> gibberish(10)
'strot fray hag sting skask stim grun prug spaf mond'

My statistics are a little fuzzy, but this may be enough for non-NSA purposes. Note that random.sample() operates without replacement. I should also point out that if a malicious party was aware you were using this method, it would be vulnerable to a dictionary attack. A pinch of salt would help with that.

Update: For those interested, an updated and fork-able version of this is available at https://github.com/greghaskins/gibberish.

6
  • 1
    This is something like the algorithm I used back in ~1995 to generate random passwords for trial accounts on an online service. Except I wrote that in Applesoft BASIC. :-) My algorithm would occasionally slip an h in before or after the vowel for added exhoticness.
    – kindall
    Mar 31, 2011 at 16:42
  • @kindall +1 "exhoticness". Perhaps I'll add oy, ji, ch, ee, zz, fj, and tz for a little multicultural flavor =) Mar 31, 2011 at 17:09
  • 1
    One other thing I'll note ... you've gotta be careful that this thing doesn't produce profanity. I had a step in my program that would throw out a pseudo-word if it contained certain naughty substrings. You have done well by not including "ck" as a terminal cluster, but I think your code could still produce some very vulgar words. Hm, maybe not though... you did also eliminate "c" from the first position.
    – kindall
    Mar 31, 2011 at 17:18
  • Good point. Don't want anyone to overhear you whispering certain choice words as you key in that passphrase. Mar 31, 2011 at 17:42
  • Want some bheer to go with your exhoticness?
    – John C
    Mar 31, 2011 at 20:07
4

I'm a big fan of the xkcd password generator. Very customizable, pip installable, and the "acrostic" feature provides a nice way to give users a memory clue for their generated word set.

3

You can create a simple Markov text generator and then train it with a list of common/pronounceable words.

Some time ago I wrote a simple generator for fun. Here it is:

#! /usr/bin/python

from cStringIO import StringIO
from sys import argv
import random

USAGE="usage: ./markov.py input_file"
END_TAG='<end>'
SEPARATOR='\n'

def append(model,token, target):
    if token not in model:
        model[token]=[]
    model[token].append(target)

def add_to_model(model,word, end_tag=END_TAG):
    append(model,'',word[:2])
    for i in xrange(len(word)-2):
        append(model, word[i:i+2],word[i+2])
    append(model,word[-2:],end_tag)

def generate(model, end_tag=END_TAG):
    ret=''
    while True:
        cur=random.choice(model[ret[-2:]])
        if cur==end_tag:
            break
        else:
            ret+=cur
    return ret

if __name__=='__main__':
    if len(argv)>1:
        data=file(argv[1],'r').read().split(SEPARATOR)
        model={}
        for word in data:
            add_to_model(model,word)
        print generate(model)
    else:
        print USAGE
3
  • 1
    Looks interesting - how much entropy would it generate? I presume it's based on the input file, so if I had lots of numbers and symbols in the text file, it would be stronger. But then, how do you avoid things like a zero and '0' together, or 1/l? Or is that also based on the input file - so if the file never has them in same string, the Markov generator learns not to put them together?
    – John C
    Mar 31, 2011 at 14:52
  • Actually, right after commenting, it occurs to me I could leave out 1/0 - that seems to cause 90% of my problems in reading computer-generated passwords. :)
    – John C
    Mar 31, 2011 at 14:54
  • @John C: That's right. The strings generated depend entirely on the contents of the input file.
    – MAK
    Mar 31, 2011 at 15:06
2

I like Simon Sapin's version: http://exyr.org/2011/random-pronounceable-passwords/

1

I guess the project I worked on is applicable. I learned a Markov Model from over 14 million passwords (from the RockYou.com password dump), and created artificial passwords that way. The blog post (and accompanying code) are here. Some sampled artificial passwords:

  • tablester111
  • genny0
  • mikk92
  • lvingree10633769
  • bubuzzarap71666
  • isamistilloro13020
  • dunl0velyiristalecasia4799

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.