diff --git a/scripts/taler-bank/demo-withdraw-api.py b/scripts/taler-bank/demo-withdraw-api.py
index 282b761..8da7792 100755
--- a/scripts/taler-bank/demo-withdraw-api.py
+++ b/scripts/taler-bank/demo-withdraw-api.py
@@ -129,11 +129,11 @@ def _rand_username() -> str:
 
 
 def _rand_password() -> str:
-    # Always embed "pleasechangeme" so users know to set their own later.
-    # Suffix: readable, no ambiguous 0/O/1/l.
+    # Embed "pleasechangeme" with random material before and after.
     alphabet = "ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz23456789"
-    suffix = "".join(secrets.choice(alphabet) for _ in range(8))
-    return "pleasechangeme" + suffix
+    prefix = "".join(secrets.choice(alphabet) for _ in range(4))
+    suffix = "".join(secrets.choice(alphabet) for _ in range(6))
+    return prefix + "pleasechangeme" + suffix
 
 
 def create_personal_account() -> dict: