mpg
mpg is a command-line tool that generates strings of random characters that can be used as reasonably secure passwords.
Passwords are, by default, chosen from the union of three character classes: upper-case letters, lower-case letters, and digits.
Options can be given to omit any one or two of these character classes. For instance, you can omit uppercase letters and digits with mpg --upper=false --digit=false. This will return a password composed only of lowercase letters.
Passwords are guaranteed to contain at least one of each selected character class. The default length is 16. mpg will create a password of any length greater than or equal to the number of character classes selected.
If the password length is less than or equal to the total number of characters selected, mpg will not repeat characters within the generated password. For instance, in the default configuration of mpg, 62 characters are selected (26 uppercase, 26 lowercase, and 10 digits) and so a length of 62 or less will not repeat any character.
Installation
I maintain a Homebrew tap.
brew install mcornick/tap/mpg
I maintain a Scoop bucket.
scoop bucket add mcornick https://github.com/mcornick/scoop-bucket.git
scoop install mpg
I maintain container images on GitHub and Docker Hub.
docker run --rm ghcr.io/mcornick/mpg
# or, for Docker Hub
docker run --rm mcornick/mpg
Note
Container signatures are an ongoing experiment. They might be broken. Do not depend on them (or, really, on mpg) for mission-critical things.
Container manifests are signed with Cosign. The signatures are created with Cosign's "keyless" mode, which requires setting COSIGN_EXPERIMENTAL=1 when using Cosign versions prior to 2.0.0:
env COSIGN_EXPERIMENTAL=1 cosign verify ghcr.io/mcornick/mpg
# or, for Docker Hub
env COSIGN_EXPERIMENTAL=1 cosign verify mcornick/mpg
I maintain binary releases on GitHub here. As of version 1.0.21, releases are built for macOS (universal), Linux (i386, amd64, arm64, and armv6) and Windows (i386, amd64). Linux packages are built in RPM, DEB, APK, and Arch Linux pkg.tar.zst formats.
Binary checksums included on the release pages are signed with my GPG key.
RPM packages are also available from my Gemfury repository.
Note
I do not, and do not intend to, submit mpg to any distribution's official repositories.
# /etc/yum.repos.d/mcornick.repo
[fury]
name=mcornick yum repo
baseurl=https://yum.fury.io/mcornick/
enabled=1
gpgcheck=0
DEB packages are also available from my Gemfury repository.
Note
I do not, and do not intend to, submit mpg to any distribution's official repositories.
# /etc/apt/sources.list.d/mcornick.list
deb [trusted=yes] https://apt.fury.io/mcornick/ /
I maintain an AUR for mpg.
Note
I do not, and do not intend to, submit mpg to Arch Linux's official AUR.
git clone https://github.com/mcornick/mpg-aur.git
cd mpg-aur
makepkg -i
The usual: go install github.com/mcornick/mpg@latest
While I no longer build or test for platforms other than the ones listed under the Binaries tab, mpg is simple enough that it should still work on any platform supported by Go, and if you find that it does not, feel free to file a GitHub issue and I'll take a look.
Usage
Command Line
$ mpg --help
mpg is a command-line tool that generates strings of random characters
that can be used as reasonably secure passwords.
Usage:
mpg [flags]
mpg [command]
Available Commands:
completion Generate completion script
help Help about any command
man Generate man page
Flags:
-c, --config string config file (default /Users/mcornick/Library/Application Support/mpg/config.yaml)
-d, --digit include digits (default true)
-h, --help help for mpg
-l, --length int length (default 16)
-u, --lower include lowercase (default true)
-U, --upper include uppercase (default true)
-v, --version version for mpg
Use "mpg [command] --help" for more information about a command.
Configuration File
mpg supports an optional configuration file. To be used by default, it must be in a format supported by viper, such as YAML, TOML, or JSON; be named config.XXXX with the proper format suffix; use the command line options as keys; and be located in one of these directories:
$HOME/Library/Application Support/mpg(macOS)$XDG_CONFIG_HOME/mpg(Unix)/etc/mpg(macOS or Unix)%AppData%\mpg(Windows)
You can also specify an arbitrary location for the configuration file with the --config option. It still needs to be in a supported format.
For example, these files replicate the default configuration of mpg:
---
digit: true
length: 16
lower: true
upper: true
digit = true
length = 16
lower = true
upper = true
{
"digit": true,
"length": 16,
"lower": true,
"upper": true
}
A JSON Schema for the configuration file is available for editors that support it.
Environment Variables
Configuration is also possible using environment variables. For example, these environment variables would replicate the default configuration of mpg:
export MPG_DIGIT=1
export MPG_LENGTH=16
export MPG_LOWER=1
export MPG_UPPER=1
(To disable uppercase, lowercase, or digits, set the appropriate variable to 0.)
The order of precedence for configuration is:
- Values given on the command line
- Values given as environment variables
- Values in the configuration file
Contributing to mpg
If you think you have a problem, improvement, or other contribution towards the betterment of mpg, please file an issue or, where appropriate, a pull request.
Keep in mind that I'm not paid to write Go code, so I'm doing this in my spare time, which means it might take me a while to respond.
When filing a pull request, please explain what you're changing and why. Please use standard Go formatting (go fmt is your friend.) Please limit your changes to the specific thing you're fixing and isolate your changes in a topic branch that I can merge without pulling in other stuff.
mpg uses Conventional Changelog style. Please follow this convention. Scopes are not required in commit messages.
mpg uses the MIT license. Please indicate your acceptance of the MIT license by using git commit --signoff.
mpg is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the Contributor Covenant code of conduct.
Thanks for contributing!
Etcetera
mpg releases are announced on a Mastodon account which you are welcome to follow.
To verify signatures on commits to mpg, you might need my GPG public key or my SSH public key.