How to generate a random password using OpenSSL

Application installers, admin consoles, and bootstrap scripts often need a one-time password before a permanent secret store is ready. OpenSSL can generate that secret locally from the operating system random source, keeping the value out of online generators and third-party pages.

The openssl rand command accepts a byte count, then prints those bytes as Base64 or hexadecimal text. The byte count is not the final visible length; 24 random bytes become 32 Base64 characters or 48 hexadecimal characters.

Base64 is compact and accepted by many secret fields, but it can include +, /, and =. Use hexadecimal for fields that reject punctuation, and remove shell variables or temporary files after the generated value has been copied into the intended password manager, vault, or application setting.

1. Generate a Base64 password from 24 random bytes.

   $ openssl rand -base64 24
   7d11ix/t52o78Wx2MGxuakg2hzBk/8Ii

   Twenty-four input bytes divide evenly into Base64 groups, so the output is 32 visible characters without = padding.

2. Generate a hexadecimal password when the destination rejects punctuation.

   $ openssl rand -hex 24
   684b2eff8544666660ec40c81dc2c82f73d1ec60f06e1e82

   Hexadecimal output uses only 0-9 and a-f. Each random byte prints as two characters, so 24 bytes produce 48 characters.

3. Set restrictive permissions before saving a generated password to a file.

   $ umask 077

   umask 077 makes new files readable only by the current user for the rest of the shell session unless a later command changes the mask.

4. Write a Base64 password to a temporary file.

   $ openssl rand -base64 -out app-password.txt 24

   Treat the file as a live secret. Do not create it in a shared repository, synced folder, ticket attachment, or terminal log that other people can read.

5. Check the saved password file permissions.

   $ ls -l app-password.txt
   -rw------- 1 user user 33 Jun 30 08:13 app-password.txt

   The file size includes the trailing newline that OpenSSL writes after the Base64 text.

6. Read the saved password once for copying.

   $ cat app-password.txt
   BCjokF690RJ0x4RkPZNnDlYalvGVu4TO

7. Remove the temporary password file after storing the value.

   $ rm -v app-password.txt
   removed 'app-password.txt'

   Regenerate the password if it was exposed in shell history, screenshots, logs, shared notes, or any place outside the intended secret store.