home / password
secretgenerator · password
Auditable random password generator
Uses the OS CSPRNG with rejection sampling, no modulo bias. Default 20 characters at ~119 bits — well above the NIST SP 800-63B-4 floor. Class requirements (lower, upper, digit, symbol) are guaranteed, not nudged.
defaults
| length | 20 |
| charset | alphanum-v1 |
| min entropy | 80 bits (NIST floor) |
| algorithm | crypto/rand + rejection sampling |
generate
runs in your browser · WebAssembly · same code as the CLIcli
secretgenerator password --json --show-crack-time
secretgenerator password --length 24 --charset alphanum-symbols-v1 --require-classes lower,upper,digit,symbol --json
secretgenerator password --require-schema-version=1 --json
snippets
import secretgenerator_py as sg result = sg.password(length=24, charset="alphanum-symbols-v1", require_classes="lower,upper,digit,symbol") print(result["password"], "—", result["entropy_bits"], "bits")
import { execFileSync } from "node:child_process";
const json = execFileSync("secretgenerator", [
"password", "--json", "--require-schema-version=1",
"--length", "24", "--charset", "alphanum-symbols-v1", "--require-classes", "lower,upper,digit,symbol"
], { encoding: "utf8" });
const out = JSON.parse(json);
console.log(out.password, "—", out.entropy_bits, "bits"); use secretgenerator::{password, PasswordOptions};
let r = password(PasswordOptions::default().length(24).charset("alphanum-symbols-v1").require_classes("lower,upper,digit,symbol"))?;
println!("{} ({:.1} bits)", r.password, r.entropy_bits);
# Ok::<_, secretgenerator::Error>(()) package main
import (
"fmt"
"github.com/rafaelperoco/secretgenerator/pkg/secretgen"
)
func main() {
res, err := secretgen.Password(secretgen.PasswordOptions{
Length: 24,
CharsetID: "alphanum-symbols-v1",
RequiredClasses: "lower,upper,digit,symbol",
})
if err != nil { panic(err) }
fmt.Printf("%s (%.1f bits)\n", res.Password, res.EntropyBits)
} faq
Is this safer than letting Claude or ChatGPT generate the password?
Yes. Recent studies show LLMs produce passwords with ~20 bits of effective entropy regardless of what they claim — they cannot uniformly sample. secretgenerator delegates to the OS CSPRNG so every output is uniform across the chosen charset.
Why does the JSON output omit the password by default in some commands?
It does not for password — the password field is part of schema v1. The entropy subcommand omits it because the caller already has the candidate. See docs/SCHEMA.md.
Can I disable the entropy floor?
Pass --allow-weak. The output will carry a warning entry that propagates to the audit log so the deviation is recorded.