我的代码的主要目标是:

弦的分布几乎是均匀的(不关心微小的偏差，只要它们很小) 它为每个参数集输出超过几十亿个字符串。如果您的PRNG只生成20亿(31位熵)不同的值，那么生成8个字符的字符串(约47位熵)是没有意义的。 它是安全的，因为我希望人们使用它作为密码或其他安全令牌。

第一个属性是通过对字母大小取一个64位值的模来实现的。对于小字母(例如问题中的62个字符)，这导致了可以忽略不计的偏差。第二个和第三个属性是通过使用RNGCryptoServiceProvider而不是System.Random来实现的。

using System;
using System.Security.Cryptography;

public static string GetRandomAlphanumericString(int length)
{
    const string alphanumericCharacters =
        "ABCDEFGHIJKLMNOPQRSTUVWXYZ" +
        "abcdefghijklmnopqrstuvwxyz" +
        "0123456789";
    return GetRandomString(length, alphanumericCharacters);
}

public static string GetRandomString(int length, IEnumerable<char> characterSet)
{
    if (length < 0)
        throw new ArgumentException("length must not be negative", "length");
    if (length > int.MaxValue / 8) // 250 million chars ought to be enough for anybody
        throw new ArgumentException("length is too big", "length");
    if (characterSet == null)
        throw new ArgumentNullException("characterSet");
    var characterArray = characterSet.Distinct().ToArray();
    if (characterArray.Length == 0)
        throw new ArgumentException("characterSet must not be empty", "characterSet");

    var bytes = new byte[length * 8];
    new RNGCryptoServiceProvider().GetBytes(bytes);
    var result = new char[length];
    for (int i = 0; i < length; i++)
    {
        ulong value = BitConverter.ToUInt64(bytes, i * 8);
        result[i] = characterArray[value % (uint)characterArray.Length];
    }
    return new string(result);
}

(这是我对如何在c#中生成随机8个字符，字母数字字符串的回答的副本?)

如果你想使用System.Web.Security.Membership.GeneratePassword使用的加密安全随机数生成，但又想将字符集限制为字母数字字符，你可以使用regex过滤结果:

static string GeneratePassword(int characterCount)
{
    string password = String.Empty;
    while(password.Length < characterCount)
        password += Regex.Replace(System.Web.Security.Membership.GeneratePassword(128, 0), "[^a-zA-Z0-9]", string.Empty);
    return password.Substring(0, characterCount);
}

我不喜欢Membership.GeneratePassword()创建的密码，因为它们太丑了，有太多特殊字符。

这段代码生成一个10位不太难看的密码。

string password = Guid.NewGuid().ToString("N").ToLower()
                      .Replace("1", "").Replace("o", "").Replace("0","")
                      .Substring(0,10);

当然，我可以使用一个Regex来做所有的替换，但这是更具可读性和可维护性的IMO。

总有system。web。security。membership。GeneratePassword(int length, int numberOfNonAlphanumericCharacters)。

public string GenerateToken(int length)
{
    using (RNGCryptoServiceProvider cryptRNG = new RNGCryptoServiceProvider())
    {
        byte[] tokenBuffer = new byte[length];
        cryptRNG.GetBytes(tokenBuffer);
        return Convert.ToBase64String(tokenBuffer);
    }
}

(你也可以让这个方法所在的类实现IDisposable，持有对RNGCryptoServiceProvider的引用，并正确地处理它，以避免重复实例化它。)

It's been noted that as this returns a base-64 string, the output length is always a multiple of 4, with the extra space using = as a padding character. The length parameter specifies the length of the byte buffer, not the output string (and is therefore perhaps not the best name for that parameter, now I think about it). This controls how many bytes of entropy the password will have. However, because base-64 uses a 4-character block to encode each 3 bytes of input, if you ask for a length that's not a multiple of 3, there will be some extra "space", and it'll use = to fill the extra.

If you don't like using base-64 strings for any reason, you can replace the Convert.ToBase64String() call with either a conversion to regular string, or with any of the Encoding methods; eg. Encoding.UTF8.GetString(tokenBuffer) - just make sure you pick a character set that can represent the full range of values coming out of the RNG, and that produces characters that are compatible with wherever you're sending or storing this. Using Unicode, for example, tends to give a lot of Chinese characters. Using base-64 guarantees a widely-compatible set of characters, and the characteristics of such a string shouldn't make it any less secure as long as you use a decent hashing algorithm.

我知道这是一个旧线程，但我有什么可能是一个相当简单的解决方案供某人使用。易于实现、易于理解、易于验证。

考虑以下要求:

我需要一个随机密码生成，其中至少有2个小写字母，2个大写字母和2个数字。密码长度至少为8个字符。

下面的正则表达式可以验证这种情况:

^(?=\b\w*[a-z].*[a-z]\w*\b)(?=\b\w*[A-Z].*[A-Z]\w*\b)(?=\b\w*[0-9].*[0-9]\w*\b)[a-zA-Z0-9]{8,}$

这超出了这个问题的范围——但是正则表达式是基于前向/后向和前后向的。

下面的代码将创建一个匹配这个要求的随机字符集:

public static string GeneratePassword(int lowercase, int uppercase, int numerics) {
    string lowers = "abcdefghijklmnopqrstuvwxyz";
    string uppers = "ABCDEFGHIJKLMNOPQRSTUVWXYZ";
    string number = "0123456789";

    Random random = new Random();

    string generated = "!";
    for (int i = 1; i <= lowercase; i++)
        generated = generated.Insert(
            random.Next(generated.Length), 
            lowers[random.Next(lowers.Length - 1)].ToString()
        );

    for (int i = 1; i <= uppercase; i++)
        generated = generated.Insert(
            random.Next(generated.Length), 
            uppers[random.Next(uppers.Length - 1)].ToString()
        );

    for (int i = 1; i <= numerics; i++)
        generated = generated.Insert(
            random.Next(generated.Length), 
            number[random.Next(number.Length - 1)].ToString()
        );

    return generated.Replace("!", string.Empty);

}

要满足上述要求，只需调用以下命令:

String randomPassword = GeneratePassword(3, 3, 3);

代码以一个无效字符(“!”)开始——这样字符串就有一个长度，可以向其中注入新字符。

然后，它从1循环到所需的小写字符#，在每次迭代中，从小写列表中抓取一个随机项，并将其注入字符串中的随机位置。

然后对大写字母和数字重复循环。

这将返回长度=小写字母+大写字母+数字的字符串，其中您想要的计数的小写字母、大写字母和数字字符已按随机顺序放置。