Comment by simontabor

Yes, but it's by far the lesser of two evils. You can easily take a substring of the generated password.

How would you randomise the length of the password in a repeatable + secure manner?