Need a secure password generator recommendation

java password-generator
Brian Matthews picture Brian Matthews · Nov 3, 2010 · Viewed 34.7k times · Source

Can anybody recommend a secure password generator available under a Apache or LGPL licence for Java?

Answer

Knubo picture Knubo · Nov 3, 2010

I would not worry that much about generating incredible strong one time passwords. Make the password long and it should not be a problem with brute force granted you limit how long the password is valid. If the password is only valid for say 1 hour then it will not be a problem if the password remains unused. And in that time span it is not likely that someone will get to crack it using brute force.

It is also important that you only let the one time password work just one time. This way, if the password is intercepted the user will notice when the one time password has expired and can take appropriate actions.

I'd go for Apache Commons RandomStringUtils and let the password be 10-15 characters of letters and numbers.

...though it always is a question of how paranoid you want to be. This solution would be fine for a regular web application, but not good enough for a bank...

Related questions

How do I convert a String to an int in Java?

How can I convert a String to an int in Java? My String contains only numbers, and I want to return the number it represents. For example, given the string "1234" the result should be the number 1234.

Read More
How do I declare and initialize an array in Java?

How do I declare and initialize an array in Java?

Read More
How do I generate random integers within a specific range in Java?

How do I generate a random int value in a specific range? I have tried the following, but those do not work: Attempt 1: randomNum = minimum + (int)(Math.random() * maximum); // Bug: `randomNum` can be bigger than `maximum`. Attempt 2: Random rn = new …

Read More