@heaventreeuk/passcrunch-core

Cryptographically secure password, passphrase and random-string generation with honest entropy and crack-time estimates. Zero dependencies. Runs entirely locally: nothing is sent anywhere. It is the same code that powers passcrunch.com.

import { generatePassword, generatePassphrase, randomString, assessStrength, formatCrackTime } from "@heaventreeuk/passcrunch-core";

generatePassword({ length: 20, symbols: false });
// { value: "k9XmP2vLq8nQ4zTrB7wY", bits: 119.1, poolSize: 62 }

generatePassphrase({ words: 8 });
// { value: "Trick-Weave-Piano-Faith-Sugar-Policy-Aware-Earth-111", bits: 70.4, wordListSize: 449 }

randomString({ format: "hex", length: 64 });   // a 256-bit secret

assessStrength("Password1!");
// { bits: 12, level: "Weak", crackTime: "Instantly", note: "This is a very common password…", … }

formatCrackTime(103); // "Longer than the age of the universe"

Guarantees

• Secure randomness only. Uses crypto.getRandomValues with rejection sampling, so there is no modulo bias. It throws if no secure source exists rather than falling back to Math.random.
• Honest numbers. Crack time is the average time to search half the keyspace at 10 billion guesses a second against a fast hash such as MD5. Slow hashes (bcrypt, Argon2) and online rate limits make real attacks far slower.
• Realistic scoring. assessStrength caps common passwords, keyboard and alphabet runs, repeated characters and word phrases instead of scoring them as random text.
• Strength bands: Weak < 40, Moderate 40 to 60, Strong 60 to 80, Very Strong 80 to 100, Super Strong 100+ bits.

Requires Node 19+ or any modern browser. MIT licensed.