How do you generate a “safe” password for use in web.config?

Question

I need to programmatically generate a password for a SQL Server connection string that will be stored in web.config.

The password contained < which interfered with the build and deployment process. I would like to avoid having this and other "problem" characters from used by a password generator. Is there a list of such characters, or some code snippets that will generate a secure, but XML "safe" password?

Answer 1

Base64 encoded characters are all considered safe.

The particular set of 64 characters chosen to represent the 64 place-values for the base varies between implementations. The general strategy is to choose 64 characters that are both members of a subset common to most encodings, and also printable. This combination leaves the data unlikely to be modified in transit through information systems, such as email, that were traditionally not 8-bit clean. 1 For example, MIME's Base64 implementation uses A–Z, a–z, and 0–9 for the first 62 values. Other variations share this property but differ in the symbols chosen for the last two values; an example is UTF-7.

This is what you can use to embed image data inside an HTML document. For example:

You can easily encode to Base64 using string libraries or online tools and they'll handle special characters like spaces, commas and brackets.

hello there, how (are) <you> doing?

Encodes to

aGVsbG8gdGhlcmUsIGhvdyAoYXJlKSA8eW91PiBkb2luZz8=

It's also worth noting that .NET probably has libraries for generating safe hashes and passwords.