pwdgen-core

pwdgen-core is a small dependency-free ESM password generation core for browsers and Node.js runtimes that provide Web Crypto.

It is maintained as part of PwdGen and uses crypto.getRandomValues() with rejection sampling. It does not use Math.random().

Install

npm install pwdgen-core

Usage

import { generate, entropyBits, PwdGenCore } from 'pwdgen-core';

const password = generate({ length: 20, symbols: true });
const bits = entropyBits({ length: 20, alphabetSize: 64 });

const local = new PwdGenCore();
const batch = local.generateMany({ count: 5, length: 24 });

Security model

• Randomness comes from crypto.getRandomValues().
• Bounded random choices use rejection sampling to avoid modulo bias.
• The entropy helper reports a theoretical upper bound for uniformly random choices from a known alphabet. It is not a breach guarantee and does not replace password reuse checks or contextual strength estimation.
• This package does not send generated values over the network.

More details: PwdGen security methodology and developer documentation.