Build a password generator

Setting RANDOM to a fixed value reseeds it, and the same seed always produces the same sequence, so the output is computed from a small seed rather than drawn from the device randomness. On top of that, each value is a whole number from 0 to 32767, which is only fifteen bits of range. A password needs a source with far more state and no way to replay it from a seed you can set. The other options are not true of $RANDOM.

The pipeline usually returns twenty characters, which is why the idiom spreads. The problem is the mechanism. head exits the moment it has its twenty bytes and closes the pipe, while tr is still writing, so tr is killed by a signal part way through its work. Correctness depends on that signal rather than on the two tools agreeing on a length, and in a script that inspects the status of every stage the same line can report a broken pipe. A tool that asks the kernel for exactly the bytes it needs avoids the race, which is why the lesson uses openssl rand.

Entropy is the length times the log base 2 of the alphabet size. The log base 2 of 62 is about 5.95, so twenty characters give about 20 times 5.95, which is about 119 bits. The other numbers come from common mistakes: 62 is the alphabet size, not the bits, and 20 is the length. Six is close to the bits a single character contributes, which is the per character figure rather than the total.

A byte runs from 0 to 255, and 256 is not a multiple of most alphabet sizes, so a plain modulo would hand the first few positions a slightly better chance than the rest. The limit is the largest multiple of the alphabet size that fits in a byte, and any byte at or above it is discarded and drawn again. That is what makes every position equally likely, and it is why the finished script is not biased even though it is short.