Membership.GeneratePassword doesn't conform to numberOfNonAlphaNumericCharacters

Question

I'm using Membership.GeneratePassword(10, 0).

i.e. Number of Non-AlphaNumeric characters should be zero, as per the MSDN defintion: http://msdn.microsoft.com/en-us/library/system.web.security.membership.generatepassword(VS.80).aspx

However, I noted that this didn't conform to what I expected. Is there a bug in the algorithm, or is it normal to see this? I still see a fair amount of punctuation characters in the password that is generated when I expect to see zero.

As a test, I threw a Grid on an ASP.NET page and wrote this to see what the output was:

public partial class Verification : System.Web.UI.Page
{
    protected void Page_Load(object sender, EventArgs e)
    {
        int max = 0; // change as required
        List<MemberPassword> list = new List<MemberPassword>();
        for (int i = 0; i <= 20; i++)
        {
            for (int j = 0; j <= max; j++)
            {
                string display = String.Format("Membership.GeneratePassword(10, {0})", j);
                list.Add(new MemberPassword(i, j, Membership.GeneratePassword(10, j), display));
            }
        }

        this.GridView1.DataSource = list;
        this.GridView1.DataBind();
    }
}

public class MemberPassword
{
    public MemberPassword(int id, int numNonAlphaNum, string password, string display)
    {
        this.Id = id;
        this.NumNonAlphaNum = numNonAlphaNum;
        this.Password = password;
        this.Display = display;
    }

    public int Id { get; set; }
    public int NumNonAlphaNum { get; set; }
    public string Password { get; set; }
    public string  Display { get; set; }
}

Although the results show a progression towards more and more punctuation, the actual requirement is not honoured.

Have I got the wrong end of the stick here or am I losing the plot? :-)

Answer 1

That documentation is out of date. Try this one:

http://msdn.microsoft.com/en-us/library/system.web.security.membership.generatepassword.aspx

The minimum number of punctuation characters in the generated password.

Answer 2

I do have a class library that uses membership api to generate the random password. Since you have mentioned that we can't generate password with no special character in using .net framework 3.5 because document says "minimal". What I need to do to reference system.web 2.0 reference in my class library project to use 2.0 version so it works fine. I can't see the System.web.dll for framework 3.5 I only have 2.0 version even though I have 3.5 framework installed. Any clue?