Simple secure standalone “offline” app to generate securely random passwords

Question

I'm looking for an app (used on laptop) to generate long, securely random, 1-use passwords that are impossible to be memorized.

It must be "offline" or at least openly verifiably sandboxed from a possibly malicious server.

The random seed must be cryptographically secure.

It's best if it allows an additional option for "variable user input" for modifying the random seed, eg via keyboard/mouse etc.

It's best if it's not from US/UK/Canada, but if so, it's best there is proper evidence that there is no FBI backdoor.

Answer 1

OK, since you are on a Mac, you can take advantage of that under the hood Unix goodness.

All *nix systems provide /dev/random, or possibly /dev/urandom or /dev/arandom. These provide random data base on noise generated by device drivers, OS function calls, all sorts of stuff to provide true randomness.

So, what you can do to generate random stuff suitable for password use is a little command line magic. Open the Terminal.app thingie, and at the prompt something like

dd if=/dev/random bs=1 count=100 | openssl sha -sha256

This should give you output like

$ dd if=/dev/random bs=1 count=100 | openssl sha -sha256
100+0 records in
100+0 records out
100 bytes copied, 0.000293454 s, 341 kB/s
(stdin)= f4a5f44ee7351ba4d1f2ca7a7722ae79c0cbbb5e3ab4e9b60ddcfa92368e6ff1

and that nice long string can be used as a password.

What is this doing? It is grabbing 100 random bytes of data provided by /dev/random and instead of outputting to a file or the screen the output is piped to be the input for the openssl command.

Feel free to use more/less bytes of random data. In fact, if just having a nice long random string works for your purposes you could get the SHA256 hash of files on your system, etc.