Does SecureRandom string with tr translate show an abundance of underscores?

Question

I use Devise and try to use Devise.friendly_token to generate passwords just to find that it creates unwanted special characters. I found that Devise.friendly_token uses this method:

SecureRandom.urlsafe_base64(15).tr('lIO0', 'sxyz')

Trying to remove the special characters "-", "=" and "_", I replaced the call to Devise.friendly_token as follows:

SecureRandom.urlsafe_base64(15).tr('lIO0=-_', 'sxyzEMU')

However, I found that there was an excessive number of characters "U", replacing the underscores (obviously, some of them are actually "U"). So, I tried this call, which eliminated the translation of "_" to "U".

SecureRandom.urlsafe_base64(15).tr('lIO0=-', 'sxyzEM')

This showed a more reasonable distribution of the results, but it still leaves a special underscore.

Can someone tell me why this is happening and how to solve it? Output Example:

irb(main):017:0> SecureRandom.urlsafe_base64(15).tr('lIO0=-_', 'sxyzEMU').first(8)
=> "mvgjptsy"
irb(main):018:0> SecureRandom.urlsafe_base64(15).tr('lIO0=-_', 'sxyzEMU').first(8)
=> "UUh1fUU-"
irb(main):019:0> SecureRandom.urlsafe_base64(15).tr('lIO0=-_', 'sxyzEMU').first(8)
=> "UgU4U981"
irb(main):020:0> SecureRandom.urlsafe_base64(15).tr('lIO0=-_', 'sxyzEMU').first(8)
=> "UUUU1q27"
irb(main):021:0> SecureRandom.urlsafe_base64(15).tr('lIO0=-_', 'sxyzEMU').first(8)
=> "ajU7zjUn"
irb(main):022:0> SecureRandom.urlsafe_base64(15).tr('lIO0=-_', 'sxyzEMU').first(8)
=> "UxgUwt7U"
irb(main):023:0> SecureRandom.urlsafe_base64(15).tr('lIO0=-_', 'sxyzEMU').first(8)
=> "UUpUcUvU"
irb(main):024:0> SecureRandom.urlsafe_base64(15).tr('lIO0=-_', 'sxyzEMU').first(8)
=> "U4UbU2ho"
irb(main):025:0> SecureRandom.urlsafe_base64(15).tr('lIO0=-_', 'sxyzEMU').first(8)
=> "icsU7bcs"
irb(main):026:0> SecureRandom.urlsafe_base64(15).tr('lIO0=-_', 'sxyzEMU').first(8)
=> "5vfdfUoU"
irb(main):027:0> SecureRandom.urlsafe_base64(15).tr('lIO0=-', 'sxyzEM').first(8)
=> "1Q71wib4"
irb(main):028:0> SecureRandom.urlsafe_base64(15).tr('lIO0=-', 'sxyzEM').first(8)
=> "TzkKT9s6"
irb(main):029:0> SecureRandom.urlsafe_base64(15).tr('lIO0=-', 'sxyzEM').first(8)
=> "iWGBgys_"
irb(main):030:0> SecureRandom.urlsafe_base64(15).tr('lIO0=-', 'sxyzEM').first(8)
=> "hkxNPGKg"
irb(main):031:0> SecureRandom.urlsafe_base64(15).tr('lIO0=-', 'sxyzEM').first(8)
=> "sHMDeAsc"
irb(main):032:0> SecureRandom.urlsafe_base64(15).tr('lIO0=-', 'sxyzEM').first(8)
=> "Tov7bYaB"
irb(main):033:0> SecureRandom.urlsafe_base64(15).tr('lIO0=-', 'sxyzEM').first(8)
=> "4vMLFdSJ"
irb(main):034:0> SecureRandom.urlsafe_base64(15).tr('lIO0=-', 'sxyzEM').first(8)
=> "zxstSvs8"
irb(main):035:0> SecureRandom.urlsafe_base64(15).tr('lIO0=-', 'sxyzEM').first(8)
=> "rMEdizyG"
irb(main):036:0> SecureRandom.urlsafe_base64(15).tr('lIO0=-', 'sxyzEM').first(8)
=> "gXK33_ux"

Answer 1

A symbol is -used String#trto indicate a range of characters. If you had in mind -, you need to avoid it with a backslash. The example changed =to E, >to M, and all characters from ?to _(including all uppercase letters) to U, therefore, the abundance of U.

To get the expected result, use this:

SecureRandom.urlsafe_base64(15).tr('lIO0=\-_', 'sxyzEMU')