Use secrets, not random, and remember the shuffle

Python gives you two ways to pick something at random, and only one of them belongs anywhere near a password. random is a Mersenne Twister. It is fast, it is reproducible, and that second property is exactly the problem: it is a deterministic algorithm driven by internal state. Observe enough of its output and you can recover that state and predict everything it will produce next. For a dice roll or a shuffled playlist, wonderful. For anything that guards access, disqualifying.