If this password is never visible to the end user, is there any good reason to do this extra fanciness, rather than just using 7-bit-ascii lowercase + numbers?  (Or if we're worried about installations in locales where the Roman character set isn't accepted, isn't the set of numbers always legit?)