Generating 10-character passwords, with 3-6 digits and 3-6 uppercase letters, in C++ In response to a question on Information Security on brute-forcing passwords, I wrote code that helped solve the problem:


  Generate a password list of 10 character passwords containing only a combination of 3 - 6 numbers and 3 - 6 uppercase letters.


I'd like a code review done of the snippet I wrote.  I don't know really anything about optimizing software. I can write it (self-taught) but I don't have the deep insights needed to improve already working software, so I've started posting code snippets in here for you guys to give me insights. I really think this channel is great and without further ado, I'll get to it.

#include &lt;iostream&gt;
#include &lt;vector&gt;
#include &lt;random&gt;
#include &lt;string&gt;

const char charset[] = {'A','B','C','D','E','F','G','H','I','J','K','L','M','N','O','P','Q','R','S','T','U','V','W','X','Y','Z','0','1','2','3','4','5','6','7','8','8','9'};
int main()
{

    std::cout &lt;&lt; "Please enter the number of passwords to generate here: ";
    int num_pass;
    std::cin &gt;&gt; num_pass;
    std::random_device dev;
    std::mt19937_64 rng(dev());
    std::vector&lt;std::string&gt; passwds;
    std::uniform_int_distribution&lt;std::mt19937_64::result_type&gt; dist(0, sizeof(charset) - 1);

    for (int i = 0; i &lt; num_pass; ++i) {
        std::string pass = "";
        int num_nums = 0, num_chars = 0;
        while (pass.length() &lt; 10) {
            char c = charset[dist(rng)];
            if (isdigit(c) &amp;&amp; num_nums &lt; 6) {
                pass += c;
                num_nums++;
            }
            else if (isalpha(c) &amp;&amp; num_chars &lt; 6) {
                pass += c;
                num_chars++;
            }
        }
        passwds.push_back(pass);
        std::cout &lt;&lt; pass &lt;&lt; std::endl;
    }
    std::cin.get();
}
```
Your passwords will be biased, with more letters appearing towards the front of the password and more digits towards the end.

A better approach would be to determine how many digits you will have in the password. Then, for each character, determine if it should be a digit based on the number of digits you want to have and the number of characters left to fill by checking if (random(characters_left) &lt; digits_left).  Then select either a random digit or letter for that position.

When you declare pass, you don't need to pass it an empty string.  It is default constructed as empty.

std::string pass;