Ah, I see.

Did you test your solution on macOS btw? I know macOS uses an ancient version of Bash and has different binaries that act differently vs Linux (such as sed). I don't have a Mac here but I do try to make my dotfiles compatible with it. If your solution works on macOS it would be nice to drop the pwgen dependency.