生成有效密码-Python

Question

I have the following method to generate random passwords:

char_set = {
'small': 'abcdefghijklmnopqrstuvwxyz',
'nums': '0123456789',
'big': 'ABCDEFGHIJKLMNOPQRSTUVWXYZ',
'special': '^!\$%&/()=?{[]}+~#-_.:,;<>|\\'
}

def gen_password(length=21):
    '''
    Generate a random password containing upper and lower case letters,
    numbers and special characters.

    Arguments:
    ----------
    The default length is 21 chars, however the minimum is 8 chars.

    Returns:
    --------
    str: The random password
    '''
    assert length >= 8
    password = []

    while len(password) < length:
        key = random.choice(char_set.keys())
        a_char = os.urandom(1)
        if a_char in char_set[key]:
            if check_prev_char(password, char_set[key]):
                continue
            else:
                password.append(a_char)
    return ''.join(password)

def check_prev_char(password, current_char_set):
    '''
    Ensure that there are not consecutive Uppercase / Lowecase / Number / special
    characters in the password.

    Arguments:
    ----------
    password: (str)
        The candidate password
    current_char_set: (char)
        The current character to be compared.

    Returns:
    --------
    Bool: if the candidate password is good so far.
    '''

    index = len(password)
    if index == 0:
        return False
    else:
        prev_char = password[index - 1]
        if prev_char in current_char_set:
            return True
        else:
            return False

Although it works in most cases, there are a few cases it fails, for example, when the password has a \\ or doesn't have a number. How can I ensure all the passwords I'm generating doesn't contain \\ and also always contain at least a number?

Answer 1

If you don't want \\ in your password, remove them from the special charset (is there a reason it's there?):

'special': '^!\$%&/()=?{[]}+~#-_.:,;<>|'

To ensure it always has a number, generate a password with n-1 characters and then add a number at a random position:

def gen_final_password(length=21):
    password = gen_password(length - 1)
    index = random.randint(0, length)
    number = random.choice(char_set['nums'])
    return password[:index] + number + password[index:]

But please note this may not generate a cryptographically random password, with the full expected entropy. For that you would need to always use a crypto-random source and use all characters with equal likelihood. Right now the algorithm prefers characters from small charsets (eg it's more likely to include a 0 than a ). Also, avoiding consecutive characters of the same charset has unknown, bad implications to entropy.

Finally, check_prev_char can be simplified to the expression:

len(password) and password[-1] in char_set[key]

Answer 2

^(?!.*\\)(?=.*\d).*$

您可以在末尾进行re.match ，以确保password没有/且至少有一个\\d 。

Answer 3

If you do not want the password you generate to contain '\\', why not just remove that character from the defined char_set you obtain characters for the password from?

As for generating the passwords that always have at least one number, you could check the generated password for a number before returning it and overwrite a random character with a random number before returning the password if a number is needed.