It's simple enough to generate a random string in Python (such as Python entropy shows). But are there any Python projects out there, which will generate password strings that are both somewhat pronounceable and readable? By readable, I mean not putting both zeros and O's in the same string, etc. I don't care if it's got maximum entropy, just something better than what I'm likely to pick. :)
5 Answers
If you're really just looking for something "better than I can make up" and
"pronounceable," then maybe just use random.sample()
to pull from a list of
consonant-vowel-consonant pseudosyllables:
import string
import itertools
import random
initial_consonants = (set(string.ascii_lowercase) - set('aeiou')
# remove those easily confused with others
- set('qxc')
# add some crunchy clusters
| set(['bl', 'br', 'cl', 'cr', 'dr', 'fl',
'fr', 'gl', 'gr', 'pl', 'pr', 'sk',
'sl', 'sm', 'sn', 'sp', 'st', 'str',
'sw', 'tr'])
)
final_consonants = (set(string.ascii_lowercase) - set('aeiou')
# confusable
- set('qxcsj')
# crunchy clusters
| set(['ct', 'ft', 'mp', 'nd', 'ng', 'nk', 'nt',
'pt', 'sk', 'sp', 'ss', 'st'])
)
vowels = 'aeiou' # we'll keep this simple
# each syllable is consonant-vowel-consonant "pronounceable"
syllables = map(''.join, itertools.product(initial_consonants,
vowels,
final_consonants))
# you could trow in number combinations, maybe capitalized versions...
def gibberish(wordcount, wordlist=syllables):
return ' '.join(random.sample(wordlist, wordcount))
Then you just choose a suitably large number of "words":
>>> len(syllables)
5320
>>> gibberish(4)
'nong fromp glosk zunt'
>>> gibberish(5)
'samp nuv fog blew grig'
>>> gibberish(10)
'strot fray hag sting skask stim grun prug spaf mond'
My statistics are a little fuzzy, but this may be enough for non-NSA
purposes. Note that random.sample()
operates without replacement. I should also point out that if a malicious party was aware you were using this method, it would be vulnerable to a dictionary attack. A pinch of salt would help with that.
Update: For those interested, an updated and fork-able version of this is available at https://github.com/greghaskins/gibberish.
-
1This is something like the algorithm I used back in ~1995 to generate random passwords for trial accounts on an online service. Except I wrote that in Applesoft BASIC. :-) My algorithm would occasionally slip an
h
in before or after the vowel for added exhoticness.– kindallMar 31, 2011 at 16:42 -
@kindall +1 "exhoticness". Perhaps I'll add
oy
,ji
,ch
,ee
,zz
,fj
, andtz
for a little multicultural flavor =) Mar 31, 2011 at 17:09 -
1One other thing I'll note ... you've gotta be careful that this thing doesn't produce profanity. I had a step in my program that would throw out a pseudo-word if it contained certain naughty substrings. You have done well by not including "ck" as a terminal cluster, but I think your code could still produce some very vulgar words. Hm, maybe not though... you did also eliminate "c" from the first position.– kindallMar 31, 2011 at 17:18
-
Good point. Don't want anyone to overhear you whispering certain choice words as you key in that passphrase. Mar 31, 2011 at 17:42
-
I'm a big fan of the xkcd password generator. Very customizable, pip installable, and the "acrostic" feature provides a nice way to give users a memory clue for their generated word set.
You can create a simple Markov text generator and then train it with a list of common/pronounceable words.
Some time ago I wrote a simple generator for fun. Here it is:
#! /usr/bin/python
from cStringIO import StringIO
from sys import argv
import random
USAGE="usage: ./markov.py input_file"
END_TAG='<end>'
SEPARATOR='\n'
def append(model,token, target):
if token not in model:
model[token]=[]
model[token].append(target)
def add_to_model(model,word, end_tag=END_TAG):
append(model,'',word[:2])
for i in xrange(len(word)-2):
append(model, word[i:i+2],word[i+2])
append(model,word[-2:],end_tag)
def generate(model, end_tag=END_TAG):
ret=''
while True:
cur=random.choice(model[ret[-2:]])
if cur==end_tag:
break
else:
ret+=cur
return ret
if __name__=='__main__':
if len(argv)>1:
data=file(argv[1],'r').read().split(SEPARATOR)
model={}
for word in data:
add_to_model(model,word)
print generate(model)
else:
print USAGE
-
1Looks interesting - how much entropy would it generate? I presume it's based on the input file, so if I had lots of numbers and symbols in the text file, it would be stronger. But then, how do you avoid things like a zero and '0' together, or 1/l? Or is that also based on the input file - so if the file never has them in same string, the Markov generator learns not to put them together?– John CMar 31, 2011 at 14:52
-
Actually, right after commenting, it occurs to me I could leave out 1/0 - that seems to cause 90% of my problems in reading computer-generated passwords. :)– John CMar 31, 2011 at 14:54
-
@John C: That's right. The strings generated depend entirely on the contents of the input file.– MAKMar 31, 2011 at 15:06
I like Simon Sapin's version: http://exyr.org/2011/random-pronounceable-passwords/
I guess the project I worked on is applicable. I learned a Markov Model from over 14 million passwords (from the RockYou.com password dump), and created artificial passwords that way. The blog post (and accompanying code) are here. Some sampled artificial passwords:
- tablester111
- genny0
- mikk92
- lvingree10633769
- bubuzzarap71666
- isamistilloro13020
- dunl0velyiristalecasia4799