We want to generate strings that can be used as passwords (storing later will be done with ex.: bcrypt, but these are the literally meant passwords). 

On a Linux machine, the two generation methods are: 

```
head -c 8192 /dev/urandom | md5sum | cut -d' ' -f1
head -c 8192 /dev/urandom | tr -cd '0123456789abcdef' | cut -c-32

```

**Which method provides "more security"?** Are there any slight difference between the two outputs? 

I'm thinking that the second one could be better, since it is "truly random". 

The first one with md5 (imho) cannot be better than the second one since it uses a hash, that could have **collisions** (with a very low chance, but it could have). 

```
[user@notebook ~]$ head -c 8192 /dev/urandom | md5sum | cut -d' ' -f1
62ef651ded5c26dbc9cbc4194e60facd
[user@notebook ~]$ head -c 8192 /dev/urandom | tr -cd '0123456789abcdef' | cut -c-32
c0fe36c50d4b9898fbf77be5f46bc375
[user@notebook ~]$ 

```

So both have the same length, both use the same available characters, both have the same random inputs. 

I recently read that there are random generators based on hash: Hash-DRBG so not sure. 

Of course pwgen could be used to generate passwords, but the question is that which of these two generating methods are more secure? 

If the question is not 100% clear, I can adjust it, just ask please.