--- a/cutils/genpwd.py	Sat Feb 08 11:44:58 2025 +0100
+++ b/cutils/genpwd.py	Sat Feb 08 12:57:14 2025 +0100
@@ -74,11 +74,7 @@
         "--version", "-v", action="version",
         version="%s (rv:%s)" % (__version__, __revision__))
     aparser.add_argument(
-        "-E", dest="use_bin_length", action="store_true",
-        help="For some repertoires make OUTPUT-LENGTH the number of bytes"
-             " that is to be read from random sources instead of output bytes")
-    aparser.add_argument(
-        "--repertoire", "--type", "-t",
+        "--algorithm", "-a",
         choices=("web", "safe-web", "safe-web-2",
                  "uri", "safe-uri", "safe-uri-2",
                  "ascii", "safe-ascii",
@@ -87,58 +83,66 @@
                  "bin-ascii85",),
         default="safe-ascii",
         help="""
-Select from a character repertoire.
-All repertoires that start with "bin-" just encode the output of
+Select an algorithm and (implicitly) a character repertoire.
+All repertoires that start with `bin-' just encode the output of
 "os.urandom()" with the selected encoder.
+All repertoires that end with `-safe' or `safe-2' do not contain visually
+similar characters (currently `0O' or `Il1').
+All repertoires that end with `-2' are variants with a bias to punctuation
+characters.        
 Default: safe-ascii
 """)
     aparser.add_argument(
+        "-E", dest="use_bin_length", action="store_true",
+        help="For some repertoires make OUTPUT-LENGTH the number of bytes"
+             " that is to be read from random sources instead of output bytes")
+    aparser.add_argument(
         "req_length", metavar="OUTPUT-LENGTH", type=int,
         help="The required length of the generated output")
 
     opts = aparser.parse_args(args=argv)
 
-    if opts.repertoire == "web":
+    if opts.algorithm == "web":
         pwd = gen_from_repertoire(opts.req_length, WEB_CHARS)
-    elif opts.repertoire == "safe-web":
+    elif opts.algorithm == "safe-web":
         pwd = gen_from_repertoire(opts.req_length, SAFE_WEB_CHARS)
-    elif opts.repertoire == "safe-web-2":
+    elif opts.algorithm == "safe-web-2":
         pwd = gen_from_repertoire(opts.req_length, SAFE_WEB_CHARS_2)
-    elif opts.repertoire == "uri":
+    elif opts.algorithm == "uri":
         pwd = gen_from_repertoire(opts.req_length, URI_CHARS)
-    elif opts.repertoire == "safe-uri":
+    elif opts.algorithm == "safe-uri":
         pwd = gen_from_repertoire(opts.req_length, SAFE_URI_CHARS)
-    elif opts.repertoire == "safe-uri-2":
+    elif opts.algorithm == "safe-uri-2":
         pwd = gen_from_repertoire(opts.req_length, SAFE_URI_CHARS_2)
-    elif opts.repertoire == "ascii":
+    elif opts.algorithm == "ascii":
         pwd = gen_from_repertoire(opts.req_length, FULL_ASCII)
-    elif opts.repertoire == "safe-ascii":
+    elif opts.algorithm == "safe-ascii":
         pwd = gen_from_repertoire(opts.req_length, SAFE_ASCII)
-    elif opts.repertoire == "alnum":
+    elif opts.algorithm == "alnum":
         pwd = gen_from_repertoire(opts.req_length, ALNUM)
-    elif opts.repertoire == "safe-alnum":
+    elif opts.algorithm == "safe-alnum":
         pwd = gen_from_repertoire(opts.req_length, SAFE_ALNUM)
-    elif opts.repertoire == "bin-base64":
+    elif opts.algorithm == "bin-base64":
         encoder = base64.b64encode
         pwd = gen_bin(opts.req_length, opts.use_bin_length, encoder,
                       rstrip_chars=b"=")
-    elif opts.repertoire == "bin-urlsafe-base64":
+    elif opts.algorithm == "bin-urlsafe-base64":
         encoder = base64.urlsafe_b64encode
         pwd = gen_bin(opts.req_length, opts.use_bin_length, encoder,
                       rstrip_chars=b"=")
-    elif opts.repertoire == "bin-base32":
+    elif opts.algorithm == "bin-base32":
         encoder = base64.b32encode
         pwd = gen_bin(opts.req_length, opts.use_bin_length, encoder,
                       rstrip_chars=b"=")
-    elif opts.repertoire == "bin-ascii85":
+    elif opts.algorithm == "bin-ascii85":
         encoder = base64.a85encode
         pwd = gen_bin(opts.req_length, opts.use_bin_length, encoder)
-    elif opts.repertoire == "bin-hex":
+    elif opts.algorithm == "bin-hex":
         encoder = binascii.hexlify
         pwd = gen_bin(opts.req_length, opts.use_bin_length, encoder)
     else:
-        raise NotImplementedError("type not yet implemented: %s"
-                                  % opts.repertoire)
+        raise NotImplementedError("algorithm not yet implemented: %s"
+                                  % opts.algorithm)
     if opts.use_bin_length:
         if len(pwd) < opts.req_length:
             raise AssertionError("internal length mismatch")