>>> [!note] Migrated issue <!-- Drupal.org comment --> <!-- Migrated from issue #1811780. --> Reported by: [1mundus](https://www.drupal.org/user/771276) >>> <p><em>(This issue has been usurped to address a slightly different issue now)</em></p> <h3 id="summary-problem-motivation">Problem/Motivation</h3> <p>Current 8.x-1.x and 7.x-1.x branches <code>genpass_password($length)</code> is now near identical to <code>user_password($length)</code> function except that it uses a potentially larger pool of source characters.</p> <p>The 7.x-2.x branch has an alternative password generation algorithm which guarantees that the password will contain at least one character from each of the following character sets.</p> <pre>&nbsp; // This array contains the list of allowable characters for the<br>&nbsp; // password. Note that the number 0 and the letter 'O' have been<br>&nbsp; // removed to avoid confusion between the two. The same is true<br>&nbsp; // of 'I', 1, and 'l'.<br>&nbsp; $character_sets = array(<br>&nbsp;&nbsp;&nbsp; 'lower_letters' =&gt; 'abcdefghijkmnopqrstuvwxyz',<br>&nbsp;&nbsp;&nbsp; 'upper_letters' =&gt; 'ABCDEFGHJKLMNPQRSTUVWXYZ',<br>&nbsp;&nbsp;&nbsp; 'digits' =&gt; '23456789',<br>&nbsp;&nbsp;&nbsp; 'special' =&gt; '@#$%^&amp;()=/|[]{};&lt;&gt;/',<br>&nbsp; );</pre><p> <a href="https://git.drupalcode.org/project/genpass/blob/7.x-2.x/genpass.module#L84">https://git.drupalcode.org/project/genpass/blob/7.x-2.x/genpass.module#L84</a></p> <p>This is a simple method of guaranteeing that the password will always have at least one character from each set, to create a more complex password.</p> <p>The current code will always produce a password which is ($lengh + 4) characters long, and with the first 4 characters being one of each of the character sets in the order above.</p> <p>Possible password space size is <code>25 x 24 x 8 x 18 x (25 + 24 + 8 + 18)^$length</code> which is several orders of magnitude smaller that a password that is the same final length but can be any character. (Ignoring the double up of character <code>/</code> as this is a bug)</p> <p>Due to the difference in the size of the character sets, there is not an even distribution of character use over the generation of passwords when each is forced to be included at least once. eg The digits set is normally usually has a probably of <code>8 / 75 = 0.10666..</code> of being included in each position. If it is forced to be included it has a probably of 1 of being included at least once and 0.10666 of being included for every additional character. It was much less likely to be included randomly and so ends up being more prevalent in generated passwords using this method.</p> <p>The increase in length of the returned password to <code>$length + count($character_sets)</code> does increase the password space which depending on the length of requested password, creates a vastly higher entropy password the was asked for. It does however break the expected result of the function by not returning a password of the same length as any of the other hook_password functions.</p> <h3 id="summary-proposed-resolution">Proposed resolution</h3> <p>Include this method of password generation in 8.x-1.x branch.</p> <p>Update the method to make passwords that are less predictable for their first 4 characters by shuffling the password characters before returning. This should be back-ported.</p> <p>In keeping with <code>user_password($length)</code> and the <code>hook_password()</code> implemented by the 8.x-1.x branch of this module, always return a password that is <code>$length</code> characters long. Users will need to be informed that they should increase the length of the password by N (~2) to reach the same password space size as that of a random password. This could be calculated for the default source characters.</p> <p>Increase the total number of special/symbol characters that can be included as part of a password to all of those which can be entered into a password box, excepting those which look too similar to another character.</p> <p>Allow developers to alter the source character sets via code in case they have some specific need to change them.</p> <p>Remove the ability to set the source characters via UI.</p> <h3 id="summary-remaining-tasks">Remaining tasks</h3> <ul> <li>Remove "Generated password entropy" admin setting.</li> <li>Add hook_genpass_character_sets_alter() which is called just before password generation begins. NB: Without using random_int, the limit for any one character set length, and the combined length must not exceed 256 characters; throw an exception.</li> <li>hook_update_N update to remove defunct setting.</li> <li><del>Wrap random_int to deal with older PHP versions.</del></li> <li>Document hook_password in api file if not present elsewhere</li> </ul> <h3 id="summary-ui-changes">User interface changes</h3> <ul> <li>Admin interface has been changed; "Generated password entropy" setting is now gone.</li> </ul> <h3 id="summary-api-changes">API changes</h3> <ul> <li>The <code>$length</code> parameter is now required and expected for all implementations of <code>hook_password()</code>.</li> </ul> <h3 id="summary-data-model-changes">Data model changes</h3> <p>None.</p> <h3 id="summary-release-notes">Release notes snippet</h3> <p>@todo</p> <h3 id="summary-original">Original issue summary</h3> <blockquote><p> Hi,</p> <p>thank you for this great module, it's a life saver.</p> <p>Before I generate all of the passwords, I'm curious what's the difference between the two password generation algorithms provided - genpass and user?</p> <p>Are both of the passwords then compatible with the new password hasing mechanism in Drupal 7, i. e. will they be transferable to Drupal 8? </p></blockquote>