--- a/cutils/genpwd.py	Sat Feb 08 09:47:34 2025 +0100
+++ b/cutils/genpwd.py	Sat Feb 08 10:39:49 2025 +0100
@@ -27,11 +27,27 @@
 from . import (__version__, __revision__)
 
 
-WEB_CHARS = b"ABCDEFGHIJKLMNOPQRSTUVWYXZabcdefghijklmnopqrstuvwxyz" \
-            b"0123456789.,-_;!()[]{}*"
-WEB_SAFE_CHARS = b"ABCDEFGHJKLMNPQRSTUVWYXZabcdefghijkmnopqrstuvwxyz" \
-                 b"23456789.,-_;!"
+WEB_CHARS = (b"ABCDEFGHIJKLMNOPQRSTUVWYXZabcdefghijklmnopqrstuvwxyz"
+             b"0123456789.,-_;!()[]{}*")
+WEB_SAFE_CHARS = (b"ABCDEFGHJKLMNPQRSTUVWYXZabcdefghijkmnopqrstuvwxyz"
+                  b"23456789.,-_;!")
 WEB_SAFE2_CHARS = b".,-_;!" + WEB_SAFE_CHARS   # prefer punctionation chars
+# Most visible characters but no space
+FULL_ASCII = (b"0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ"
+              b"abcdefghijklmnopqrstuvwxyz!#$%&/()*+-.,:;<=>?@^_`[\\]{|}'\"~")
+#
+# A safer variant of FULL_ASCII:
+# - no characters that are visually similar (0O, 1lI)
+# - no characters with dead keys on german keyboards
+# - no backslash (too easily interpret as escape character
+# - no single or double quotes
+SAFE_ASCII = (b"23456789ABCDEFGHJKLMNPQRSTUVWXYZ"
+              b"abcdefghijkmnopqrstuvwxyz!#$%&/()*+-.,:;<=>?@_[]{|}~")
+# just numeric and alphabetic
+ALNUM = b"0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"
+# safer alpha-numberic without visually similar characters
+SAFE_ALNUM = b"23456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz"
+
 
 PY2 = sys.version_info[0] <= 2
 
@@ -50,7 +66,8 @@
              " that is to be read from random sources instead of output bytes")
     aparser.add_argument(
         "--repertoire", "--type", "-t",
-        choices=("web", "web-safe", "web-safe2",
+        choices=("web", "web-safe", "web-safe2", "ascii", "safe-ascii",
+                 "alnum", "safe-alnum",
                  "bin-base64", "bin-urlsafe-base64", "bin-base32",
                  "bin-ascii85", "bin-hex", ),
         default="web-safe2",
@@ -72,6 +89,14 @@
         pwd = gen_from_repertoire(opts.req_length, WEB_SAFE_CHARS)
     elif opts.repertoire == "web-safe2":
         pwd = gen_from_repertoire(opts.req_length, WEB_SAFE2_CHARS)
+    elif opts.repertoire == "ascii":
+        pwd = gen_from_repertoire(opts.req_length, FULL_ASCII)
+    elif opts.repertoire == "safe-ascii":
+        pwd = gen_from_repertoire(opts.req_length, SAFE_ASCII)
+    elif opts.repertoire == "alnum":
+        pwd = gen_from_repertoire(opts.req_length, ALNUM)
+    elif opts.repertoire == "safe-alnum":
+        pwd = gen_from_repertoire(opts.req_length, SAFE_ALNUM)
     elif opts.repertoire == "bin-base64":
         encoder = base64.b64encode
         pwd = gen_bin(opts.req_length, opts.use_bin_length, encoder,