Writing a Simple Password Generator in Racket
There are many places in todays world where you need to provide a password and, since it is not recommended to reuse them, you will need to come up with many such passwords, all of them preferably secure. This blog post shows how to build a simple password generator. You may already use a password manager and may not have a need for a new one, still, this blog post might show you a few useful techniques for building Racket applications.
Two things are needed to generate a secure password: a cryptographically secure random number and a way to convert this number in a string of letters, numbers and symbols which can be used as a password.
To generate a secure random number, we can use the Racket cryptorandombytes
function, this function uses the underlying OS facilities to generate cryptographically secure random numbers. However, the function returns a vector of bytes, rather than a single integer. Since Racket supports arbitrarily large integers, we can write a function which converts the random bytes into a single big integer. It is more convenient to use the usual arithmetic operations even if the numbers involved have 512 or 1024 bits:
1 2 3 4 5 
(define (randombignum bits) (define numbytes (exactceiling (/ bits 8))) (for/fold ([result 0]) ([byte (inbytes (cryptorandombytes numbytes))]) (+ byte (* result 256)))) 
For simplicity, the function above will round up the number of bits to the nearest multiple of 8, so, when asking for a 510 bit random number, it will return a 512 bit one:
1 2 3 4 5 
pwgen.rkt> (randombignum 512) 2149265534656356393808323702525364123006913634758130535200642 1529460948865291665389221928490091241418209211877685483113247 50742321664506075182906096005424 pwgen.rkt> 
Technically, the numbers printed out by this function can be used as passwords directly, but they are too long for practical uses. We can try printing them out in different bases, the ~r
function allows specifying a base when converting a number to its string representation:
1 2 3 4 5 6 7 8 9 10 
pwgen.rkt> (define number (randombignum 128)) pwgen.rkt> (for ([base '(10 16 32 36)]) (define e (~r number #:base base)) (printf "base ~a, length: ~a, number: ~a~%" base (stringlength e) e)) base 10, length: 38, number: 45179475995854230969429510001515414944 base 16, length: 32, number: 21fd40254dd38346ba70b7c04711c5a0 base 32, length: 26, number: 11vl02ajejgd3bks5no13h3hd0 base 36, length: 25, number: 20fvdccm8ijp6ulrxe7ppz928 pwgen.rkt> 
The higher the base, the shorter the representation of the number, this is because base 10 uses 10 symbols (the digits ‘0’ to ‘9’), but base 36 uses all the letters plus the digits, for a total of 36 symbols. This means that the same random number will use 38 characters when printed in base 10, but only 25 when printed in base 36. We could use a higher base, for example base 62, if we allow upper and lower letters plus digits, but the ~r
function is limited to base 36, so we need to write our own encoding function:
1 2 3 4 5 6 7 8 9 
(define (encodebignum bignum alphabet) (define base (stringlength alphabet)) (let loop ([result '()] [bignum bignum]) (if (> bignum 0) (letvalues (([q r] (quotient/remainder bignum base))) (let ((symbol (stringref alphabet r))) (loop (cons symbol result) q))) (list>string result)))) 
The function takes the number to encode and an alphabet, which is a string containing the valid characters to use for the encoding. We can try it out with base 10 and supplying the string “0123456789”:
1 2 3 4 5 6 
pwgen.rkt> (define number (randombignum 128)) pwgen.rkt> number 303402022734247877297530981670554688480 pwgen.rkt> (encodebignum number "0123456789") "303402022734247877297530981670554688480" pwgen.rkt> 
Our function is not limited to using numbers, we can use the letters a, b, c, d, e and f to encode the same number. Since there are only 6 symbols in our encoding, the encoding is now longer, but it represents the same random 128 bit number:
1 2 
pwgen.rkt> (encodebignum number "abcdef") "cbdacfaebbfdefadbfdadfcfdcbfffecbcdfeafdfddbbddabc" 
Creating a commandline application
We have all the building blocks we need to build a simple command line utility to generate passwords. To make it more interesting, the utility will accept command line arguments to select password strength, the alphabets to use for encoding, and will allow grouping of letters to make passwords easier to use.
We will define four alphabets for encoding the passwords: the fullalphabet
will use upper and lowercase letters, digits plus some symbols, this will produce the shortest passwords for a given bit length, but it might create passwords which are difficult to type. The normalalphabet
will use upper and lowercase letters plus digits, the lowercasealphabet
will use lower case letters plus digits and a simplifiedalphabet
will use a combination of letters and numbers which cannot be mistaken for each other (for example, it does not contain the letter l
or the digit 1
):
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 
(define fullalphabet (stringappend "abcdefghijklmnopqrstuvwxyz" "ABCDEFGHIJKLMNOPQRSTUVWXYZ" "0123456789" "~!@#$%^&*_+={}[]<>?,./")) (define normalalphabet (stringappend "abcdefghijklmnopqrstuvwxyz" "ABCDEFGHIJKLMNOPQRSTUVWXYZ" "0123456789")) (define lowercasealphabet (stringappend "abcdefghijklmnopqrstuvwxyz" "0123456789")) (define simplifiedalphabet "acefghkrstwxyz23456789") 
To make passwords easier to read and type, we can extend the encodebignum
function to insert a separator, for example a dash (
), between groups of characters to produce passwords such as “xg5z–999ghfc8z4czfw”. This is done by keeping track of the current position and inserting the separator if the current position is a multiple of the grouping:
1 2 3 4 5 6 7 8 9 10 11 12 13 
(define (encodebignum bignum alphabet group separator) (define base (stringlength alphabet)) (let loop ([position 0] [result '()] [bignum bignum]) (if (> bignum 0) (letvalues (([q r] (quotient/remainder bignum base))) (let ((symbol (stringref alphabet r))) ;; NOTE: if `group` is 0, there is no grouping (if (and (> group 0) (> position 0) (= (remainder position group) 0)) (loop (add1 position) (cons symbol (cons separator result)) q) (loop (add1 position) (cons symbol result) q)))) (list>string (reverse result))))) 
We also need to process the command line arguments passed in to the script to control password length, alphabet choice and grouping; this can be done using the commandline
macro, but since it is a macro, it interprets its arguments in a special way, which may be surprising if you expect a normal function call. See the full documentation for the macro for details, however, below is the invocation required to accept three command line arguments b
for the number of bits in the password, a
for the alphabet to use and g
for the grouping. Each of these arguments are optional and the syntax allows specifying a help text for them too, so the script will print out usage information if passed in the h
argument. Each commandline option has an argument which is a string, and the commandline
macro allows specifying some processing to be done on that argument. To keep the commandline
call simple, the setbits
, setalphabet
and setgrouping
functions are provided separately, these functions validate the argument and set the actual values for the bits, alphabet and grouping respectively:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 
(require racket/cmdline) (commandline #:program "pwgen" #:usagehelp "" "pwgen is a program to generate random passwords" "" #:onceeach (("b" "bits") arg "number of random bits in the password" (setbits arg)) (("a" "alphabet") arg ("alphabet to use for encoding" "must be one of: 'full', 'normal', 'lowercase' or 'simplified'") (setalphabet arg)) (("g" "group") arg "group characters of <arg> items, use 0 for no grouping" (setgrouping arg))) 
For completeness, here is the definition for the setbits
, setalphabet
and setgrouping
functions, they check that the parameter passed in as a string is a valid number or alphabet definition and signal an error if they are not. These functions also set values for the bits
, alphabet
and grouping
variables which will be used to generate the password, these variables already have default values, so the script will still generate a password with default parameters if some options are missing from the command line:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 
(define bits 128) (define alphabet simplifiedalphabet) (define grouping 0) (define (setbits arg) (let ((value (string>number arg))) (if (and (number? value) (integer? value) (> value 64)) (set! bits value) (error "invalid number of bits for the password, must be at least 64")))) (define (setalphabet arg) (set! alphabet (cond ((stringci=? arg "full") fullalphabet) ((stringci=? arg "normal") normalalphabet) ((stringci=? arg "lowercase") lowercasealphabet) ((stringci=? arg "simplified") simplifiedalphabet) (#t (error "unknown alphabet type"))))) (define (setgrouping arg) (let ((value (string>number arg))) (if (and (number? value) (integer? value) (> value 0)) (set! grouping value) (error "invalid grouping, must be a positive integer")))) 
All that remains is to generate the password and print it out:
With all these updates, the script can be run from the command line, you can also find in the entire program in this GitHub Gist. Here is what it looks when it runs:
$ racket pwgen.rkt b 128 g 4
tkaakrr782raw3ksegy3f768t62yc
$
Creating a racket package for our script
Racket packages are usually used for library functions, but our program provides none of those — we could export the randombignum
and encodebignum
functions, but these are simple functions and not worth having in a separate library. However, Racket packages can also be used to install additional raco
programs. This can be useful for us if we want to run our script without having to remember where we stored it on disk. To create a package for our script we will need to:

Create a directory, “pwgen” where the files will be placed

Put the racket source file in that directory, the info file requires it to be named “pwgen.rkt” — you can download it from this GitHub Gist if you don’t want to type it yourself.

Add the following to an “info.rkt” file in the same directory:
1 2 3 4 5 6 7 
 Install the package by running
raco pkg install
in the “pwgen” directory.
Note that the “pwgen.rkt” copy from the GitHub Gist has the command line parsing and program execution is placed inside a module+
section named main
. The code inside the main
submodule will only be executed when the program is run from the command line using the raco command, not when the file is required inside other files. Note how the “info.rkt” file has a racocommands
section which specifies to run the main submodule of the “pwgen/pwgen” package for its “pwgen” command.
We can now run the pwgen utility as a raco
command:
$ raco pwgen b 128 a full
R^go}[PkfljGF#B/~E
$