Can the call to .Next() throw instead of returning a password called "Try again" when a valid password could not be generated in maximumAttempts?
I think it's a big risk to return a string like that as the calling application has no way to know what was returned is not a valid password.
A dedicated exception type would be a bonus.
password = PasswordIsValid(Settings, password) ? password : "Try again";
Source