I would recommend people stop using pwgen - its main interested was generating "human-rememberable passwords", but it showed multiple vulnerabilities in doing exactly that. And using it to generate completely random strings isn't that useful either.
I wrote a detailed article on that very topic, but basically, the gist of it is to use the diceware program (or, if you like dice, the actual diceware system) or xkcdpass. To generate strong memorable passwords, I generally use diceware with the following configuration file:
[diceware]
caps = off
delimiter = "-"
wordlist = en_eff
Examples:
$ diceware
turkey-eligibly-underwire-recite-lifter-wasp
$ diceware
lend-rubdown-cornflake-tint-shawl-ozone
$ diceware
syndrome-ramp-cresting-resolved-flinch-veneering
$ diceware
alto-badass-eclipse-surplus-rudder-quit
I turn off caps and spaces because they generate distinct audible noises that could be leveraged by an attacker. The -
delimiter is a lesser evil: it would be better to not use any separator and the en_eff
wordlist is especially crafted for that purpose. But I find it easier to communicate and share passwords when they have some separator.
To generate a completely random password, I use the following shell function:
# secure password generator or, as dkg puts it:
# high-entropy compact printable/transferable string generator
# a password generator would be pwqgen or diceware
pwg() {
ENTROPY=${1:-20} # in bytes
# strip possible newlines if output is wrapped and trailing = signs as they add nothing to the password's entropy
head -c $ENTROPY /dev/random | base64 | tr -d '\n='
echo
}
I mention this because I believe it is important to memorize less passwords and instead rely on a password manager to store large strings that are hard to guess. More details about the rationale behind those choices is explained in the aforementioned article and my password managers review.