The expense of this test is making me wonder: since the user's random password is unknown to them, they won't be able to use it successfully, so what difference does it make what character set it's chosen from?  Why not just generate a binary blob and call it a password?