SecureRandom string with tr translate showing abundance of underscores?

Question

I am using Devise and attempted to use Devise.friendly_token to generate passwords only to find that it produces undesired special characters. I found that Devise.friendly_token actually uses this method:

SecureRandom.urlsafe_base64(15).tr('lIO0', 'sxyz')

Attempting to remove the special characters of "-", "=" and "_", I replaced the Devise.friendly_token call with:

SecureRandom.urlsafe_base64(15).tr('lIO0=-_', 'sxyzEMU')

However, I found that there was an overabundance of "U" characters, having replaced the underscores (obviously some of them are actually "U"). So, I tried this call which eliminated the translate of "_" to "U".

SecureRandom.urlsafe_base64(15).tr('lIO0=-', 'sxyzEM')

This showed a more reasonable distribution of results, but it still leaves the underscore special character.

Can anyone tell me why this is happening and how to resolve it? Example output is:

irb(main):017:0> SecureRandom.urlsafe_base64(15).tr('lIO0=-_', 'sxyzEMU').first(8)
=> "mvgjptsy"
irb(main):018:0> SecureRandom.urlsafe_base64(15).tr('lIO0=-_', 'sxyzEMU').first(8)
=> "UUh1fUU-"
irb(main):019:0> SecureRandom.urlsafe_base64(15).tr('lIO0=-_', 'sxyzEMU').first(8)
=> "UgU4U981"
irb(main):020:0> SecureRandom.urlsafe_base64(15).tr('lIO0=-_', 'sxyzEMU').first(8)
=> "UUUU1q27"
irb(main):021:0> SecureRandom.urlsafe_base64(15).tr('lIO0=-_', 'sxyzEMU').first(8)
=> "ajU7zjUn"
irb(main):022:0> SecureRandom.urlsafe_base64(15).tr('lIO0=-_', 'sxyzEMU').first(8)
=> "UxgUwt7U"
irb(main):023:0> SecureRandom.urlsafe_base64(15).tr('lIO0=-_', 'sxyzEMU').first(8)
=> "UUpUcUvU"
irb(main):024:0> SecureRandom.urlsafe_base64(15).tr('lIO0=-_', 'sxyzEMU').first(8)
=> "U4UbU2ho"
irb(main):025:0> SecureRandom.urlsafe_base64(15).tr('lIO0=-_', 'sxyzEMU').first(8)
=> "icsU7bcs"
irb(main):026:0> SecureRandom.urlsafe_base64(15).tr('lIO0=-_', 'sxyzEMU').first(8)
=> "5vfdfUoU"
irb(main):027:0> SecureRandom.urlsafe_base64(15).tr('lIO0=-', 'sxyzEM').first(8)
=> "1Q71wib4"
irb(main):028:0> SecureRandom.urlsafe_base64(15).tr('lIO0=-', 'sxyzEM').first(8)
=> "TzkKT9s6"
irb(main):029:0> SecureRandom.urlsafe_base64(15).tr('lIO0=-', 'sxyzEM').first(8)
=> "iWGBgys_"
irb(main):030:0> SecureRandom.urlsafe_base64(15).tr('lIO0=-', 'sxyzEM').first(8)
=> "hkxNPGKg"
irb(main):031:0> SecureRandom.urlsafe_base64(15).tr('lIO0=-', 'sxyzEM').first(8)
=> "sHMDeAsc"
irb(main):032:0> SecureRandom.urlsafe_base64(15).tr('lIO0=-', 'sxyzEM').first(8)
=> "Tov7bYaB"
irb(main):033:0> SecureRandom.urlsafe_base64(15).tr('lIO0=-', 'sxyzEM').first(8)
=> "4vMLFdSJ"
irb(main):034:0> SecureRandom.urlsafe_base64(15).tr('lIO0=-', 'sxyzEM').first(8)
=> "zxstSvs8"
irb(main):035:0> SecureRandom.urlsafe_base64(15).tr('lIO0=-', 'sxyzEM').first(8)
=> "rMEdizyG"
irb(main):036:0> SecureRandom.urlsafe_base64(15).tr('lIO0=-', 'sxyzEM').first(8)
=> "gXK33_ux"

Answer 1

The - character is used by String#tr to denote a range of characters. If you meant -, you'll need to escape it with a backslash. The example was changing = into E, > into M, and all chars from ? to _ (including all uppercase letters) into U, hence the abundance of U's.

To get the result you expected, use this:

SecureRandom.urlsafe_base64(15).tr('lIO0=\-_', 'sxyzEMU')