# js-generate-password

> Tiny, dependency-free, cryptographically secure password generator for JavaScript and TypeScript projects.

Latest version **1.1.1** (published 2026-08-26) · MIT license · 0 weekly downloads

## Install

```sh
npm install js-generate-password
pnpm add js-generate-password
yarn add js-generate-password
bun add js-generate-password
```

## Health

**Score 65/100 (B)** — status: active.

Positive: has types; esm support; no vulnerabilities; recently updated; high maintenance score.

Warnings: low downloads.

## Facts

| | |
|---|---|
| Version | 1.1.1 |
| Published | 2026-08-26 |
| First published | 2022-11-07 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | bundled |
| Module format | ESM + CommonJS |
| Node | >=18 |
| Dependencies | 0 |
| Unpacked size | 31.2 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 36 |
| Author | Ahmad Joya |
| Maintainers | ahmadjoya |
| Keywords | password, password-generator, generate-password, generate-password-lite, js-generate-password, random-password, secure-password, crypto, csprng, generator, random, typescript, nodejs, react, nextjs, browser |

## Links

- npm: https://www.npmjs.com/package/js-generate-password
- Repository: https://github.com/ahmadjoya/generate-password-lite
- Homepage: https://github.com/ahmadjoya/generate-password-lite#readme
- Issues: https://github.com/ahmadjoya/generate-password-lite/issues
- npm.io page: https://npm.io/package/js-generate-password

## Alternatives

- [mobx-react](https://npm.io/package/mobx-react.md) — 2.8M weekly downloads
- [rc-tree](https://npm.io/package/rc-tree.md) — 2.6M weekly downloads
- [@react-oauth/google](https://npm.io/package/@react-oauth/google.md) — 1.3M weekly downloads
- [@wagmi/connectors](https://npm.io/package/@wagmi/connectors.md) — 877.0K weekly downloads
- [vee-validate](https://npm.io/package/vee-validate.md) — 836.4K weekly downloads

## Recent versions

- 1.1.1 (latest) — 2026-08-26
- 1.1.0 — 2026-08-26
- 1.0.0 — 2023-12-04
- 0.1.9 — 2023-06-07
- 0.1.8 — 2023-06-07
- 0.1.7 — 2022-11-11
- 0.1.6 — 2022-11-11
- 0.1.5 — 2022-11-11
- 0.1.4 — 2022-11-10
- 0.1.3 — 2022-11-08
- 0.1.2 — 2022-11-08
- 0.1.1 — 2022-11-08
- 0.1.0 — 2022-11-08
- 0.0.5 — 2022-11-08
- 0.0.4 — 2022-11-07
- … 3 more at https://npm.io/package/js-generate-password/versions

## README

<p align ="center">
  <a href="https://nodei.co/npm/js-generate-password" target="_blank">
    <img src="https://nodei.co/npm/js-generate-password.png" alt="npm Info" />
  </a>
</p>

<p align="center">
  <a href="https://npm.im/js-generate-password" target="_blank">
    <img src="https://img.shields.io/npm/v/js-generate-password.svg" alt="npm Version" />
  </a>
  <a href="https://npm.im/js-generate-password" target="_blank">
    <img src="https://img.shields.io/npm/dm/js-generate-password.svg" alt="npm Downloads" />
  </a>
  <a href="https://bundlephobia.com/package/js-generate-password" target="_blank">
    <img src="https://img.shields.io/bundlephobia/minzip/js-generate-password" alt="Bundle Size" />
  </a>
  <a href="https://github.com/ahmadjoya/generate-password-lite/blob/main/LICENSE" target="_blank">
    <img src="https://img.shields.io/npm/l/js-generate-password.svg" alt="License" />
  </a>
</p>

<p align="center">
  <a href="https://github.com/ahmadjoya/generate-password-lite/stargazers" target="_blank">
    <img src="https://img.shields.io/github/stars/ahmadjoya/generate-password-lite" alt="GitHub Stars" />
  </a>
  <a href="https://github.com/ahmadjoya/generate-password-lite/network/members" target="_blank">
    <img src="https://img.shields.io/github/forks/ahmadjoya/generate-password-lite" alt="GitHub Forks" />
  </a>
  <a href="https://github.com/ahmadjoya/generate-password-lite/issues" target="_blank">
    <img src="https://img.shields.io/github/issues/ahmadjoya/generate-password-lite" alt="GitHub Issues" />
  </a>
</p>

# js-generate-password

A tiny, dependency-free password generator for JavaScript and TypeScript projects — Node.js, React, Next.js, Vue, Svelte, Deno, Bun, and the browser.

Passwords may contain lowercase letters, uppercase letters, numbers and symbols. The `options` parameter lets you enable or disable each group, exclude specific characters, and require a minimum number of characters from each group.

- **Secure by default** — every character comes from the Web Crypto CSPRNG (`crypto.getRandomValues`), never `Math.random()`.
- **Zero dependencies** — nothing else is pulled into your lockfile.
- **Dual ESM + CommonJS** — `import` and `require` both work, with matching type declarations.
- **Fully typed** — TypeScript definitions ship with the package.

> **Note**
> This package is also published under the name [`generate-password-lite`](https://www.npmjs.com/package/generate-password-lite). The two packages are the same library — use whichever name you already depend on.

## Installation

```bash
npm install js-generate-password
```

```bash
yarn add js-generate-password
```

```bash
pnpm add js-generate-password
```

**Requirements:** Node.js 18 or newer, or any modern browser. Both provide the Web Crypto API that this package relies on.

## Usage

### ES modules / TypeScript

```ts
import { GeneratePassword } from 'js-generate-password'

const password = GeneratePassword({
  length: 14,
  symbols: true,
})

console.log(password) // => "q7#Rk2mV$pLx8w"
```

A default export is available too, if you prefer it:

```ts
import GeneratePassword from 'js-generate-password'
```

### CommonJS

```js
const { GeneratePassword } = require('js-generate-password')

const password = GeneratePassword({ length: 14, symbols: true })
```

### React

```tsx
import { useState } from 'react'
import { GeneratePassword } from 'js-generate-password'

export function PasswordField() {
  const [password, setPassword] = useState(() =>
    GeneratePassword({ length: 16, symbols: true })
  )

  return (
    <div>
      <input readOnly value={password} />
      <button onClick={() => setPassword(GeneratePassword({ length: 16, symbols: true }))}>
        Regenerate
      </button>
    </div>
  )
}
```

### Next.js

The package works in both the App Router and the Pages Router, on the server and in the browser.

```ts
// app/api/password/route.ts
import { GeneratePassword } from 'js-generate-password'

export function GET() {
  return Response.json({ password: GeneratePassword({ length: 20, symbols: true }) })
}
```

Generating a password during render of a **server component** produces a different value on the server and on the client. Generate it in an event handler, in a route handler, or inside `useState`'s initializer in a client component.

## Options

Every option is optional. Calling `GeneratePassword()` with no argument uses the defaults below.

```ts
GeneratePassword({
  length: 10,
  lowercase: true,
  uppercase: true,
  numbers: true,
  symbols: false,
  exclude: '',
  minLengthLowercase: 1,
  minLengthUppercase: 1,
  minLengthNumbers: 1,
  minLengthSymbols: 0,
})
```

| Name                 | Type      | Description                                                                       | Default |
| -------------------- | --------- | --------------------------------------------------------------------------------- | ------- |
| `length`             | `number`  | Length of the generated password. Must be a positive integer.                      | `10`    |
| `lowercase`          | `boolean` | Include lowercase letters (`a–z`).                                                 | `true`  |
| `uppercase`          | `boolean` | Include uppercase letters (`A–Z`).                                                 | `true`  |
| `numbers`            | `boolean` | Include digits (`0–9`).                                                            | `true`  |
| `symbols`            | `boolean` | Include symbols (see [Symbols](#symbols)).                                         | `false` |
| `exclude`            | `string`  | Characters to leave out of the password.                                           | `''`    |
| `minLengthLowercase` | `number`  | Minimum number of lowercase letters. Forced to `0` when `lowercase` is `false`.    | `1`     |
| `minLengthUppercase` | `number`  | Minimum number of uppercase letters. Forced to `0` when `uppercase` is `false`.    | `1`     |
| `minLengthNumbers`   | `number`  | Minimum number of digits. Forced to `0` when `numbers` is `false`.                 | `1`     |
| `minLengthSymbols`   | `number`  | Minimum number of symbols. Forced to `0` when `symbols` is `false`.                | `1`\*   |

At least one of `lowercase`, `uppercase`, `numbers` or `symbols` must be `true`.

\* `minLengthSymbols` defaults to `1` whenever you turn `symbols` on. Because `symbols` is `false` by default, the effective default for an untouched call is `0`.

### Symbols

When `symbols` is enabled the following characters are used:

```text
!#$%&'()*+,-./:;<=>?@[]^_{|}~
```

## Examples

**No options.** Defaults apply: 10 characters, upper and lowercase letters plus digits, no symbols.

```ts
import { GeneratePassword } from 'js-generate-password'

console.log(GeneratePassword())
// => "xDU6izb3PV"
```

**A longer password.**

```ts
console.log(GeneratePassword({ length: 25 }))
// => "U4c3KpQP5UrbZgTcrqMgFeI3R"
```

**Excluding characters.** Useful for dropping look-alikes such as `O`/`0` and `l`/`1`.

```ts
console.log(GeneratePassword({ length: 16, exclude: 'Ol01Il' }))
// => "gT7yqW4nZbK9vRhs"
```

**Requiring a mix.** Guarantee at least two of each group.

```ts
console.log(
  GeneratePassword({
    length: 20,
    symbols: true,
    minLengthLowercase: 2,
    minLengthUppercase: 2,
    minLengthNumbers: 2,
    minLengthSymbols: 2,
  })
)
// => "k#9Wq2mZ$vT7pL4nRj%x"
```

**Digits only, for a one-time code.**

```ts
console.log(
  GeneratePassword({
    length: 6,
    lowercase: false,
    uppercase: false,
    numbers: true,
    symbols: false,
  })
)
// => "482915"
```

## Errors

`GeneratePassword` throws an `Error` when the options cannot produce a valid password:

| Condition                                                                    | Example                                                              |
| ---------------------------------------------------------------------------- | -------------------------------------------------------------------- |
| `length` is not a positive integer                                           | `GeneratePassword({ length: 0 })`                                     |
| A `minLength*` value is not a non-negative integer                           | `GeneratePassword({ minLengthNumbers: -1 })`                          |
| Every character group is disabled                                            | `GeneratePassword({ lowercase: false, uppercase: false, numbers: false, symbols: false })` |
| The `minLength*` values add up to more than `length`                         | `GeneratePassword({ length: 4, symbols: true, minLengthSymbols: 5 })` |
| `exclude` removes every character of a group that still has a minimum        | `GeneratePassword({ exclude: '0123456789' })` — digits are on by default |

The last case is worth calling out: excluding all digits while `numbers` is still `true` is a contradiction, so it fails loudly instead of quietly returning a password with no digits.

## Security

Passwords are generated with `crypto.getRandomValues`, the cryptographically secure random source built into Node.js 18+ and every modern browser. Values are drawn using rejection sampling, so each character in the allowed set is equally likely — a plain modulo would skew the results toward the start of the alphabet.

The characters that satisfy your `minLength*` requirements are shuffled through the whole password rather than placed at the front, so the position of each group carries no information.

If `globalThis.crypto` is unavailable, the package throws rather than silently falling back to a predictable random source.

## TypeScript

The `GenerateOptions` type is exported for reuse:

```ts
import { GeneratePassword, type GenerateOptions } from 'js-generate-password'

const strongDefaults: GenerateOptions = {
  length: 24,
  symbols: true,
  minLengthSymbols: 3,
}

const password = GeneratePassword(strongDefaults)
```

## Contributing

Issues and pull requests are welcome at [github.com/ahmadjoya/generate-password-lite](https://github.com/ahmadjoya/generate-password-lite).

```bash
npm install
npm run build
npm test
```

## License

[MIT](https://github.com/ahmadjoya/generate-password-lite/blob/main/LICENSE) © Ahmad Joya

---
_Source: https://npm.io/package/js-generate-password · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._