diff --git a/perl/lib/Wallet/Config.pm b/perl/lib/Wallet/Config.pm
index 60f0e10..66d433f 100644
--- a/perl/lib/Wallet/Config.pm
+++ b/perl/lib/Wallet/Config.pm
@@ -298,6 +298,15 @@ is run before data is stored.
 
 our $PWD_LENGTH_MAX = 21;
 
+=item PWD_CHARACTERS
+
+A string that contains valid characters to be used in generating
+passwords.  The default is to allow any printable character.
+
+=cut
+
+our $PWD_CHARACTERS = '';
+
 =back
 
 =head1 KEYTAB OBJECT CONFIGURATION
diff --git a/perl/lib/Wallet/Object/Password.pm b/perl/lib/Wallet/Object/Password.pm
index 336aa9d..f581c18 100644
--- a/perl/lib/Wallet/Object/Password.pm
+++ b/perl/lib/Wallet/Object/Password.pm
@@ -81,6 +81,15 @@ sub retrieve {
         }
         my $pass = chars ($Wallet::Config::PWD_LENGTH_MIN,
                           $Wallet::Config::PWD_LENGTH_MAX);
+        if ($Wallet::Config::PWD_CHARACTERS) {
+            my @pw_chars = ();
+            for (my $i=0; $i<length($Wallet::Config::PWD_CHARACTERS); $i++) {
+                push @pw_chars, substr($Wallet::Config::PWD_CHARACTERS, $i, 1);
+            }
+            $pass = chars ($Wallet::Config::PWD_LENGTH_MIN,
+                           $Wallet::Config::PWD_LENGTH_MAX,
+                           \@pw_chars);
+        }
         print FILE $pass;
         $self->log_action ('store', $user, $host, $time);
         unless (close FILE) {