Secure random password generator I am developing an application that must generate a random password for each new user in the system (initial password).

My idea is to use passwords of 16 characters long.

Would like to know if the code below is a secure way to generate passwords and if it can be improved. The system will be used by hundreds of thousands of users and security is a priority.

import java.security.SecureRandom;
import java.util.Random;

public class SecureRandomPasswordGenerator {

    private static final Random RANDOM = new SecureRandom();
    private static final String POSSIBLE_CHARACTERS = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz_-+=!@#$%&amp;*()[]{}&lt;&gt;:.,?";

    public String generatePassword(int length) {
        StringBuilder password = new StringBuilder(length);
        for (int i = 0; i &lt; length; i++) {
            password.append(POSSIBLE_CHARACTERS.charAt(RANDOM.nextInt(POSSIBLE_CHARACTERS.length())));
        }
        return password.toString();
    }

}
Top hit on Google looks very similar; in any case no need to reinvent this.

But really, if this is the initial password, the users are going to get it how? Are the being forced to reset it immediately? All that is more a question for https://security.stackexchange.com/ than here.

But sure, looks okay, AFAIK SecureRandom is thread-safe (is that important?) and it's going to produce "random enough" output, the loop is okay too.

Though why specifically 16 characters and not e.g. 32? Do they have to enter them from a sheet of paper? Then there would be a couple of issues with it, like possibly mistaking i, I, l, L and 1, or 0, o and O, ... and so on.