Skip to content

Generate random password

GenerateRandomPWD builds a random password character-by-character from the PWDCHARLIST constant, re-seeding the random-number generator partway through the loop to reduce sequence predictability.

Field Value
Operation ID OP-SU-11
Trigger Caller calls clsSystemUser.GenerateRandomPWD([inLength])
Inputs Optional inLength (defaults to 6)
Outputs Randomly generated password string of the requested length
Primary components clsSystemUser.GenerateRandomPWD(...)
Entry point Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb

Steps

  1. Determine the character range. charLen is set to PWDCHARLIST.Length - 1, the maximum valid index into the constant character list (BR-015).
  2. Seed the random-number generator. Randomize(Now.Millisecond) seeds VB's shared random-number state using the current millisecond value.
  3. Loop once per requested character. For i from 1 to inLength:
  4. Compute newPos = CInt(Rnd() * charLen).
  5. Append PWDCHARLIST.Substring(newPos, 1) to the output string.
  6. If newPos > (charLen * 0.5), re-seed with Randomize(Now.Millisecond) again before the next iteration.
  7. Return the assembled password. The completed string is returned once the loop finishes.

Process flow

The following diagram visualizes this operation's control flow.

flowchart TD
    Start([Caller calls GenerateRandomPWD]) --> Seed[Randomize with Now.Millisecond]
    Seed --> Loop{More characters needed?}
    Loop -->|Yes| Pick[Compute random index and append character]
    Pick --> ReseedCheck{Index > half of charLen?}
    ReseedCheck -->|Yes| Reseed[Re-seed random generator]
    ReseedCheck -->|No| Loop
    Reseed --> Loop
    Loop -->|No| Return([Return assembled password])

Failure and edge-case behavior

  • PWDCHARLIST excludes visually ambiguous characters (0, O, I, l, 1) by construction, per BR-015, but the constant repeats its character set twice within the same string, which affects the relative frequency of characters rather than which characters can appear.*
  • Seeding with Now.Millisecond provides limited entropy — the seed range is bounded to a single millisecond value (0–999), which is a cryptographically weak seeding strategy for password generation.*
  • The re-seeding condition (newPos > charLen * 0.5) is a purely internal implementation detail with no externally observable effect beyond potentially altering the random sequence for subsequent characters.*
  • A caller-supplied inLength of 0 or negative produces an empty or unpredictable result since the loop bounds are 1 To inLength.*

Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts.

Sources

  • Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb