> For the complete documentation index, see [llms.txt](https://docs.devolutions.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devolutions.net/cli/guides/generate.md). # Generate passwords and SSH keys Generate strong passwords, passphrases, pattern-based passwords, and RSA SSH key pairs locally with devo generate, without signing in. `devo generate` creates passwords, passphrases, and SSH keys on your computer. It doesn't need a context, doesn't contact any workspace, and doesn't start the Devolutions CLI background process, so it works anywhere, even before you sign in. ## Pick the right generator

CHOOSE	WHAT YOU GET	USE IT WHEN
`devo generate password`	A random password with at least one lowercase letter, one uppercase letter, one digit, and one symbol. 32 characters by default.	A machine reads the password: a service account, an API, a database.
`devo generate passphrase`	Random dictionary words joined by a separator. Five English words joined by `-` by default.	A person has to type or remember it.
`devo generate human-readable`	Pronounceable syllables followed by digits and symbols. Four syllables, one digit, and one symbol by default.	You need something short that people can read aloud.
`devo generate pattern <pattern>`	One character per token of the pattern.	A system imposes a precise format.
`devo generate ssh-key`	An RSA key pair, written to two files.	You need a new SSH key for a server or a Git host.

The value is printed on its own line. With `--output json`, you get an object with the generator used and the value. See [Read results as JSON](/cli/for-devops-and-administrators/automate/json-output.md). {% hint style="info" %} To store a generated password straight in your vault without displaying it, pass it to `devo secret set` through an environment variable. See [Update a secret from a script](/cli/guides/secrets/update-a-secret.md). {% endhint %} ## Passwords ```bash devo generate password --length 24 ``` `--length` accepts 8 to 4096 characters. Without it, the password has 32 characters. ## Passphrases ```bash devo generate passphrase --words 6 --separator " " --dictionary French ```

OPTION	DEFAULT	WHAT IT DOES
`--words`	`5`	Number of words.
`--separator`	`-`	Text between the words.
`--dictionary`	`English`	Word list: `English`, `French`, or `German`.

## Human-readable passwords ```bash devo generate human-readable --syllables 5 --numerics 2 --symbols 1 ```

OPTION	DEFAULT	WHAT IT DOES
`--syllables`	`4`	Number of pronounceable syllables.
`--numerics`	`1`	Number of digits to append.
`--symbols`	`1`	Number of symbols to append.

## Pattern-based passwords Write one token per character: `u` for an uppercase letter, `l` for a lowercase letter, `d` for a digit, `s` for a symbol, `x` for any character. ```bash devo generate pattern ulllldds ``` Add `--shuffle` to mix the generated characters in a random order. ## SSH keys ```bash devo generate ssh-key --out-file ~/.ssh/id_rsa_deploy --comment "deploy@build" ``` Devolutions CLI writes the private key to `--out-file`, and the public key to the same path followed by `.pub`, unless you choose another path with `--public-out-file`. It then prints both paths and the public key, ready to paste into a server or a Git host.

OPTION	DEFAULT	WHAT IT DOES
`--out-file`	Required	Where to write the private key. The folder must exist.
`--public-out-file`	`<out-file>.pub`	Where to write the public key.
`--algorithm`	`rsa`	Key algorithm. `rsa` is the only supported value.
`--bits`	`3072`	Key size: `2048`, `3072`, or `4096`.
`--comment`	Your user name	Comment at the end of the public key.
`--passphrase-env`, `--passphrase-file`	None	Protects the private key with a passphrase read from an environment variable or a file. Use one or the other.
`--force`	Off	Replaces existing key files. Without it, the command stops if a file already exists.

The private key is a PEM file in PKCS #8 format, encrypted when you set a passphrase. The public key uses the OpenSSH format (`ssh-rsa …`). On macOS and Linux, only your user account can read the private key file. ## If it doesn't work * "The password generation options are invalid.": a value is out of range, for example a password shorter than 8 characters. The command exits with code `2`. See [Exit codes and errors](/cli/reference/exit-codes-and-errors.md). * Every option of `devo generate`: [Commands](/cli/reference/commands.md). ## Next * [Update a secret from a script](/cli/guides/secrets/update-a-secret.md) * [Run a command with its secrets](/cli/guides/secrets/run-with-secrets.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.devolutions.net/cli/guides/generate.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.