129

Port 129/tcp is registered with IANA as pwdgen with the description "Password Generator Protocol," assignee Frank J. Wacho, and it is dual-registered on both TCP and UDP (identical rows for 129/tcp and 129/udp). The IANA Reference column for the entry is blank in the registry CSV, but the protocol itself is defined in RFC 972 ("Password Generator Protocol," Frank J. Wacho, USC/ISI, January 1986), which the IETF datatracker classifies as a Legacy-status document — it never held formal standing in the IETF standards process. The protocol is minimal: a server listening on port 129 generates a small set of random, pronounceable eight-character candidate "words" and returns them, one per line (CRLF-delimited), as password suggestions. On the TCP variant the server writes the suggestions and closes the connection; on the UDP variant it replies once per datagram. The design goal was to steer users away from weak, self-chosen passwords by offering machine-generated pronounceable alternatives — a 1980s precursor to the password-generation features now built into password managers and browsers. For an analyst, port 129 is almost entirely of historical interest. No current, actively maintained software or OS package implementing RFC 972 pwdgen could be confirmed, and the port does not appear among the ports commonly reported as broadly exposed or actively scanned in current internet-wide scanning writeups. Because the protocol has no encryption and no authentication, an exposed pwdgen service would emit its generated password suggestions in plaintext to any connecting client — but the measured footprint is vanishingly small: the nmap-services dataset records an observed open-frequency of about 0.000025 for 129/tcp, roughly 2 to 3 in 100,000 scanned hosts, against about 0.000412 on the UDP side. Note also that several low-authority aggregator sites return conflicting or garbled claims for port 129 — one conflates "pwdgen"/"PGP" with Pretty Good Privacy encryption, another claims the port is unassigned or BSD rcp — both of which are contradicted by the authoritative IANA registry and the RFC 972 text and should be disregarded.

IANA assignment

pwdgen — "Password Generator Protocol"; reference (blank in the IANA Reference column of the registry CSV); assignee Frank J. Wacho; dual-registered 129/tcp + 129/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry, port 129 rows)

Range class

well-known (0–1023) [Confirmed]

Prevalence

nmap-services observed open-frequency 129/tcp ≈ 0.000025 (very low — roughly 2 to 3 in 100,000 scanned hosts in the nmap-services sample); the dual-registered 129/udp side is higher at ≈ 0.000412 [Confirmed] — nmap-services dataset. The figure records scan-observed openness on the port number, not confirmed RFC 972 pwdgen use; port 129 is not among the ports commonly reported as broadly scanned/exposed [Likely]

Related ports

contrast modern in-application / password-manager password generation (no port); no defined cluster

Primary use

name-based password suggestion service — server returns random pronounceable eight-character candidate passwords (RFC 972)

Other/unofficial uses

historical Unix inetd.conf pwdgen entries reportedly existed, but no authoritative modern implementation was found

Security implications

legacy protocol with no encryption and no authentication; an exposed service would leak generated password suggestions in plaintext to any connecting client. Measured exposure is vanishingly small (nmap-services ≈ 0.000025 on tcp)

Typically seen on

Unknown — no confirmed modern software or host population

Defining document

RFC 972 (Frank J. Wacho, USC/ISI, January 1986); Legacy status, no formal IETF standards standing [Confirmed] — https://datatracker.ietf.org/doc/rfc972/

Analyst note

Port 129 is of historical interest; a responsive pwdgen service is rare. Disregard low-authority aggregators that conflate it with "PGP" encryption or claim it is unassigned — IANA and RFC 972 assign it to pwdgen.

Port 129/udp is registered with IANA as pwdgen, "Password Generator Protocol," assignee Frank J. Wancho (rendered "Frank_J_Wacho" in the current IANA registry text), with a blank Reference field in the registry and no listed registration or modification date; the same name, description, and assignee are dual-registered identically on 129/tcp. The protocol itself is defined in RFC 972 (F. Wancho, January 1986): a client sends any UDP datagram to a PWDGEN server on port 129, and the server replies with six randomly generated, pronounceable eight-character "words" that a user could pick from as a password candidate. RFC 972 explicitly anticipated multiple independent PWDGEN servers being queried at random by client software, so that no single site's output stream could be observed or predicted, and it recommended sites offer the service to make weak, easily-guessed passwords less common on the early ARPANET. This is a mid-1980s experimental utility service that predates modern password-generation practice; no current mainstream operating system, daemon, or library was found still implementing a PWDGEN listener, and it has effectively been superseded by local tools (OS-native random generators, pwgen, password managers) that don't rely on a network round-trip to produce a password. No CVEs or dedicated security advisories specific to pwdgen/port 129 were found, and targeted searches for scan/exposure statistics (e.g., Shodan-style data) turned up nothing specific to this port — only generic scanning literature unrelated to pwdgen. Given the protocol's age and near-total disuse, a live listener on 129/udp today would be unusual and is more plausibly a legacy/embedded system relic, a decoy, or a misconfigured honeypot-style service than an intentionally deployed password utility, though this is an inference from the protocol's obsolescence rather than a sourced prevalence statistic.

IANA assignment

pwdgen — "Password Generator Protocol"; reference blank in registry; assignee Frank J. Wancho (listed "Frank_J_Wacho"); dual-registered 129/tcp + 129/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (local cached CSV, line 336; https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml)

Range class

well-known (0–1023) [Confirmed]

Registration/modification date

blank in the IANA registry; not fabricated [Confirmed] — IANA registry CSV

Current status

historical/dormant 1986-era ARPANET utility protocol, not in active use; no known CVEs [Likely] — RFC 972

Protocol reference

RFC 972, "Password Generator Protocol," F. Wancho, January 1986

Primary use

client sends any UDP datagram to port 129; server replies with six randomly generated, pronounceable eight-character password candidates; designed so multiple independent servers could be queried to make output harder to predict

Exposure/scanning notes

no scan-specific or vulnerability data found for this port; general obsolescence suggests rare real-world exposure, but this is inference, not a sourced statistic [Unknown]

Common implementations today

none identified; no sourced evidence of a maintained modern PWDGEN server [Likely] — absence-of-evidence from targeted search, RFC 972