skills/plugins/document-navigator/docs/security-stack/security/password-generator

@suaveplan/password-generator - Cryptographically-strong password and passphrase generator — char-class, pronounceable, EFF Diceware, PIN, entropy estimator. Zero browser/Node deps.

Summary

Cryptographically-strong password and passphrase generator — char-class, pronounceable, EFF Diceware, and PIN modes with bias-free RNG, real entropy estimates, and injectable Rng for deterministic replay. Universal (zero browser / Node / React deps).

The package owns the surface end-to-end: bundled EFF Long (7776) and EFF Short 1 (1296) wordlists, Lemire-style rejection-sampling randomInt for unbiased integer draws, Fisher-Yates shuffle, char-class quotas, configurable passphrase decoration, an entropy estimator, and a assertStrength guard.

Documentation tree

• charsets — (no submodules)
  • charsets — (no submodules)
• entropy — (no submodules)
  • entropy — (no submodules)
• errors — (no submodules)
  • codes — (no submodules)
• observability — (no submodules)
  • metrics — (no submodules)
• passphrase — (no submodules)
  • passphrase — (no submodules)
• password — (no submodules) - pronounceable — `generatePronounceablePassword(opts…
  • password — (no submodules) - pronounceable — `generatePronounceablePassword(opts…
  • pronounceable — generatePronounceablePassword(opts, rng?) emits CVC-pattern (consonant–vowel–consonant) syllables suitable for should…
• pin — (no submodules)
  • pin — (no submodules)
• default-rng — defaultRng() builds the default Rng backed by @suaveplan/crypto-utils.randomBytes, which delegates to `crypto.get…
• fisher-yates — shuffleInPlace(array, rng) performs an in-place Fisher–Yates / Knuth shuffle parameterised over the bias-free `random…
• random-int — randomInt(rng, max) returns a uniformly-distributed integer in the half-open interval [0, max) for any `max ∈ [1, 2…
• schemas — (no submodules)
  • schemas — (no submodules)
• eff-long — Bundles the EFF Long Wordlist as a frozen readonly string[] so callers who only want passphrase generation pull this…
• eff-short — Bundles EFF's Short Wordlist #1 — 1296 entries (4-dice / 6⁴), ≈ 10.34 bits/word, every entry ≤ 5 ASCII characters. Sour…
• registry — The wordlist registry exposes a small plugin API — registerWordlist, getWordlist, listWordlists — that lets calle…

- [charsets](./src/charsets/charsets.md) — _(no submodules)_- [entropy](./src/entropy/entropy.md) — _(no submodules)_- [entropy](./src/entropy/entropy.md) — _(no submodules)_- [errors](./src/errors/codes.md) — _(no submodules)_- [codes](./src/errors/codes.md) — _(no submodules)_- [observability](./src/observability/metrics.md) — _(no submodules)_- [metrics](./src/observability/metrics.md) — _(no submodules)_- [passphrase](./src/passphrase/passphrase.md) — _(no submodules)_- [passphrase](./src/passphrase/passphrase.md) — _(no submodules)_- [password](./src/password/password.md) — _(no submodules)_- pronounceable — `generatePronounceablePassword(opts…

• password — (no submodules)- pronounceable — `generatePronounceablePassword(opts…
• pronounceable — generatePronounceablePassword(opts, rng?) emits CVC-pattern (consonant–vowel–consonant) syllables suitable for should…
• pin — (no submodules)- pin — (no submodules)- default-rng — defaultRng() builds the default Rng backed by @suaveplan/crypto-utils.randomBytes, which delegates to `crypto.get…
• fisher-yates — shuffleInPlace(array, rng) performs an in-place Fisher–Yates / Knuth shuffle parameterised over the bias-free `random…
• random-int — randomInt(rng, max) returns a uniformly-distributed integer in the half-open interval [0, max) for any `max ∈ [1, 2…
• schemas — (no submodules)- schemas — (no submodules)- eff-long — Bundles the EFF Long Wordlist as a frozen readonly string[] so callers who only want passphrase generation pull this…
• eff-short — Bundles EFF's Short Wordlist #1 — 1296 entries (4-dice / 6⁴), ≈ 10.34 bits/word, every entry ≤ 5 ASCII characters. Sour…
• registry — The wordlist registry exposes a small plugin API — registerWordlist, getWordlist, listWordlists — that lets calle…
• charsets — (no submodules)- entropy — (no submodules)- entropy — (no submodules)- errors — (no submodules)- codes — (no submodules)- observability — (no submodules)- metrics — (no submodules)- passphrase — (no submodules)- passphrase — (no submodules)- password — (no submodules)- pronounceable — `generatePronounceablePassword(opts…
  • password — (no submodules)- pronounceable — `generatePronounceablePassword(opts…
  • pronounceable — generatePronounceablePassword(opts, rng?) emits CVC-pattern (consonant–vowel–consonant) syllables suitable for should…
• pin — (no submodules)- pin — (no submodules)- default-rng — defaultRng() builds the default Rng backed by @suaveplan/crypto-utils.randomBytes, which delegates to `crypto.get…
• fisher-yates — shuffleInPlace(array, rng) performs an in-place Fisher–Yates / Knuth shuffle parameterised over the bias-free `random…
• random-int — randomInt(rng, max) returns a uniformly-distributed integer in the half-open interval [0, max) for any `max ∈ [1, 2…
• schemas — (no submodules)- schemas — (no submodules)- eff-long — Bundles the EFF Long Wordlist as a frozen readonly string[] so callers who only want passphrase generation pull this…
• eff-short — Bundles EFF's Short Wordlist #1 — 1296 entries (4-dice / 6⁴), ≈ 10.34 bits/word, every entry ≤ 5 ASCII characters. Sour…
• registry — The wordlist registry exposes a small plugin API — registerWordlist, getWordlist, listWordlists — that lets calle…
• charsets — (no submodules)- entropy — (no submodules)- entropy — (no submodules)- errors — (no submodules)- codes — (no submodules)- observability — (no submodules)- metrics — (no submodules)- passphrase — (no submodules)- passphrase — (no submodules)- password — (no submodules)- pronounceable — `generatePronounceablePassword(opts…
  • password — (no submodules)- pronounceable — `generatePronounceablePassword(opts…
  • pronounceable — generatePronounceablePassword(opts, rng?) emits CVC-pattern (consonant–vowel–consonant) syllables suitable for should…
• pin — (no submodules)- pin — (no submodules)- default-rng — defaultRng() builds the default Rng backed by @suaveplan/crypto-utils.randomBytes, which delegates to `crypto.get…
• fisher-yates — shuffleInPlace(array, rng) performs an in-place Fisher–Yates / Knuth shuffle parameterised over the bias-free `random…
• random-int — randomInt(rng, max) returns a uniformly-distributed integer in the half-open interval [0, max) for any `max ∈ [1, 2…
• schemas — (no submodules)- schemas — (no submodules)- eff-long — Bundles the EFF Long Wordlist as a frozen readonly string[] so callers who only want passphrase generation pull this…
• eff-short — Bundles EFF's Short Wordlist #1 — 1296 entries (4-dice / 6⁴), ≈ 10.34 bits/word, every entry ≤ 5 ASCII characters. Sour…
• registry — The wordlist registry exposes a small plugin API — registerWordlist, getWordlist, listWordlists — that lets calle…
• charsets — (no submodules)- entropy — (no submodules) - entropy — (no submodules)- errors — (no submodules) - codes — (no submodules)- observability — (no submodules) - metrics — (no submodules)- passphrase — (no submodules) - passphrase — (no submodules)- password — (no submodules) - password — (no submodules) - pronounceable — generatePronounceablePassword(opts, rng?) emits CVC-pattern (consonant–vowel–consonant) syllables suitable for should…
• pin — (no submodules) - pin — (no submodules)- default-rng — defaultRng() builds the default Rng backed by @suaveplan/crypto-utils.randomBytes, which delegates to `crypto.get…
• fisher-yates — shuffleInPlace(array, rng) performs an in-place Fisher–Yates / Knuth shuffle parameterised over the bias-free `random…
• random-int — randomInt(rng, max) returns a uniformly-distributed integer in the half-open interval [0, max) for any `max ∈ [1, 2…
• schemas — (no submodules) - schemas — (no submodules)- eff-long — Bundles the EFF Long Wordlist as a frozen readonly string[] so callers who only want passphrase generation pull this…
• eff-short — Bundles EFF's Short Wordlist #1 — 1296 entries (4-dice / 6⁴), ≈ 10.34 bits/word, every entry ≤ 5 ASCII characters. Sour…
• registry — The wordlist registry exposes a small plugin API — registerWordlist, getWordlist, listWordlists — that lets calle…

Install

bun add @suaveplan/password-generator

Quick Start

import {
 assertStrength,
 estimateEntropy,
 generatePassphrase,
 generatePassword,
 generatePin,
} from "@suaveplan/password-generator";

// Char-class password
const pw = generatePassword({
 length: 16,
 requireLowercase: true,
 requireUppercase: true,
 requireDigits: true,
 requireSymbols: true,
});

// 6-word EFF Long passphrase (≈ 77.5 bits)
const phrase = generatePassphrase({});

// 6-digit PIN
const pin = generatePin(6);

// Strength check
assertStrength(pw, 80); // throws PWGEN.STRENGTH_INSUFFICIENT if < 80 bits
const { bits, charsetSize } = estimateEntropy(pw);

Tree-Shaking

Each major surface ships at its own subpath so consumers pull only what they need:

import { generatePassword } from "@suaveplan/password-generator/password";
import { generatePassphrase } from "@suaveplan/password-generator/passphrase";
import { generatePin } from "@suaveplan/password-generator/pin";
import { EFF_LONG_WORDLIST } from "@suaveplan/password-generator/wordlists/eff-long";
import { EFF_SHORT_WORDLIST } from "@suaveplan/password-generator/wordlists/eff-short";

A consumer that imports only ./password does not pull the 85 KB EFF Long list. A consumer that imports only ./pin pulls neither wordlist.

Modules

• random/random-int — bias-free randomInt via Lemire rejection sampling.
• random/fisher-yates — Fisher-Yates shuffle built on the unbiased picker.
• random/default-rng — default Rng wrapping @suaveplan/crypto-utils.randomBytes.
• charsets/charsets — LOWERCASE / UPPERCASE / DIGITS / SYMBOLS / AMBIGUOUS / LOOKALIKES + buildEffectiveCharset.
• password/password — char-class generator with required-class quotas.
• password/pronounceable — CVC-pattern pronounceable generator.
• passphrase/passphrase — EFF Diceware passphrase generator.
• pin/pin — uniform digit-only PIN generator.
• entropy/entropy — entropy estimator and assertStrength guard.
• wordlists/eff-long — bundled EFF Long Wordlist (7776 entries).
• wordlists/eff-short — bundled EFF Short Wordlist 1 (1296 entries).
• wordlists/registry — plugin API for caller- supplied wordlists.
• errors/codes — PWGEN_CODES registry and PwgenError class.
• schemas/schemas — Zod boundary schemas.
• observability/metrics — OpenTelemetry histograms and counters.

License

MIT