# Password generator - different solutions

import random
import string
import pyperclip

def __init__(self, length, contains_lowercase, contains_uppercase, contains_digits, contains_symbols):
self.length = length
self.contains_lowercase = contains_lowercase
self.contains_uppercase = contains_uppercase
self.contains_digits = contains_digits
self.contains_symbols = contains_symbols

def generate(self):
asciii = ""

# adding parts of ascii code characters depending on corresponding booleans

if self.contains_lowercase:
asciii += string.ascii_lowercase

if self.contains_uppercase:
asciii += string.ascii_uppercase

if self.contains_digits:
asciii += string.digits

if self.contains_digits:
asciii += string.punctuation

# appending random characters to an empty string from the ascii string until a its length reaches a certain value

password += asciii[ random.randint(0, len(asciii) - 1) ]

while True:

if length.isdigit() and int(length) > 0 and not length.startswith('0'):
length = int(length)
break

# empty strings converted to booleans are false

contains_lowercase = bool(input("\nWill it contain lowercase characters (a-z)? [ENTER] if not. "))

contains_uppercase = bool(input("\nWill it contain uppercase characters (A-Z)? "))

contains_digits = bool(input("\nDigits (0-9)? "))

contains_symbols = bool(input("\nSymbols? "))

print("\nCopied to clipboard!")

input("Press [ENTER] to quit: ")


I kinda dislike the last part, because of similar looking lines...

And also if checks in the Password class are repetitive

I would like to see some different approaches.

• I presume your previous attempt is here: codereview.stackexchange.com/questions/249921/… Aug 21 '21 at 17:12
• If your class has only two exposed methods, one of which is __init__, you don't want a class, but a generic function. Aug 25 '21 at 10:06

## Complexity

First: enforcing specific requirements around character types in an attempt to promote password complexity is outdated and shown to do more harm than help:

The forcing of lowercase, uppercase alphabetic characters, numbers and symbols in passwords was common policy, but has been found to actually decrease security, by making it easier to crack. Research has shown how very predictable common use of such symbols are, and the USA, UK government cyber security departments advise against forcing their inclusion in password policy. Complex symbols also makes remembering passwords much harder, which increases writing down, password resets and password reuse - all of which lower rather than improve password security. The original author of password complexity rules Bill Burr has apologised and admits they actually decrease security, as research has found, which was widely reported in the media in 2017.

It's a better idea to either:

• more generally measure the entropy of a password and compare that to some minimum (if the password is user-provided);
• use as broad a character set as at all possible if the password is being randomly generated and will be stored in a manager; or
• use a passphrase instead of a password, if it's to be memorized.

You might need code like yours to accommodate websites with misdesigned password character criteria, but in the general case you should strongly prefer a non-constrained character set.

## Secure PRNGs

You received an analogous comment on your previous password generator last year: the general-purpose random number generator provided by a framework is wholly insufficient for the purposes of secure password generation. Read the big, angry, red callout in the documentation:

Warning: The pseudo-random generators of this module should not be used for security purposes. For security or cryptographic uses, see the secrets module.

You should address these two fundamentals before continuing.

• What;s the take-away of your first part, i.e, what changes to the code would you make because of that? Aug 21 '21 at 19:57
• The code doesn't "enforcing specific requirements around character types". The code builds a pool of characters to then build from, which you've said to do "use as broad a character set as at all possible if the password is being randomly generated and will be stored in a manager". Not all sites support all character sets, which is why password generators allow users to pick which character sets to pool from. Aug 22 '21 at 15:53