diff --git a/share/rpcauth/rpcauth.py b/share/rpcauth/rpcauth.py
index d33aa07305..6edf826618 100755
--- a/share/rpcauth/rpcauth.py
+++ b/share/rpcauth/rpcauth.py
@@ -1,54 +1,51 @@
 #!/usr/bin/env python3
 # Copyright (c) 2015-2017 The Bitcoin Core developers
 # Distributed under the MIT software license, see the accompanying
 # file COPYING or http://www.opensource.org/licenses/mit-license.php.
 
 import base64
+from binascii import hexlify
 import hmac
 import os
-from random import SystemRandom
 import sys
 
 
-def generate_salt():
-    # This uses os.urandom() underneath
-    cryptogen = SystemRandom()
-
-    # Create 16 byte hex salt
-    salt_sequence = [cryptogen.randrange(256) for _ in range(16)]
-    return ''.join([format(r, 'x') for r in salt_sequence])
+def generate_salt(size):
+    """Create size byte hex salt"""
+    return hexlify(os.urandom(size)).decode()
 
 
 def generate_password():
     """Create 32 byte b64 password"""
     return base64.urlsafe_b64encode(os.urandom(32)).decode('utf-8')
 
 
 def password_to_hmac(salt, password):
     m = hmac.new(bytearray(salt, 'utf-8'),
                  bytearray(password, 'utf-8'), 'SHA256')
     return m.hexdigest()
 
 
 def main():
     if len(sys.argv) < 2:
         sys.stderr.write(
             'Please include username (and an optional password, will generate one if not provided) as an argument.\n')
         sys.exit(0)
 
     username = sys.argv[1]
 
-    salt = generate_salt()
+    # Create 16 byte hex salt
+    salt = generate_salt(16)
     if len(sys.argv) > 2:
         password = sys.argv[2]
     else:
         password = generate_password()
     password_hmac = password_to_hmac(salt, password)
 
     print('String to be appended to bitcoin.conf:')
     print('rpcauth={0}:{1}${2}'.format(username, salt, password_hmac))
     print('Your password:\n{0}'.format(password))
 
 
 if __name__ == '__main__':
     main()
diff --git a/test/util/rpcauth-test.py b/test/util/rpcauth-test.py
index 4253dc97df..43d1f3d6ab 100755
--- a/test/util/rpcauth-test.py
+++ b/test/util/rpcauth-test.py
@@ -1,50 +1,50 @@
 #!/usr/bin/env python3
 # Copyright (c) 2015-2018 The Bitcoin Core developers
 # Distributed under the MIT software license, see the accompanying
 # file COPYING or http://www.opensource.org/licenses/mit-license.php.
 """Test share/rpcauth/rpcauth.py
 """
 import base64
 import configparser
 import hmac
 import importlib
 import os
 import sys
 import unittest
 
 
 class TestRPCAuth(unittest.TestCase):
     def setUp(self):
         config = configparser.ConfigParser()
         config_path = os.path.abspath(
             os.path.join(os.sep, os.path.abspath(os.path.dirname(__file__)),
                          "../config.ini"))
         with open(config_path, encoding="utf8") as config_file:
             config.read_file(config_file)
         sys.path.insert(0, os.path.dirname(config['environment']['RPCAUTH']))
         self.rpcauth = importlib.import_module('rpcauth')
 
     def test_generate_salt(self):
-        self.assertLessEqual(len(self.rpcauth.generate_salt()), 32)
-        self.assertGreaterEqual(len(self.rpcauth.generate_salt()), 16)
+        for i in range(16, 32 + 1):
+            self.assertEqual(len(self.rpcauth.generate_salt(i)), i * 2)
 
     def test_generate_password(self):
         password = self.rpcauth.generate_password()
         expected_password = base64.urlsafe_b64encode(
             base64.urlsafe_b64decode(password)).decode('utf-8')
         self.assertEqual(expected_password, password)
 
     def test_check_password_hmac(self):
-        salt = self.rpcauth.generate_salt()
+        salt = self.rpcauth.generate_salt(16)
         password = self.rpcauth.generate_password()
         password_hmac = self.rpcauth.password_to_hmac(salt, password)
 
         m = hmac.new(bytearray(salt, 'utf-8'),
                      bytearray(password, 'utf-8'), 'SHA256')
         expected_password_hmac = m.hexdigest()
 
         self.assertEqual(expected_password_hmac, password_hmac)
 
 
 if __name__ == '__main__':
     unittest.main()