# password-generator

> Memorable password generator for Node and browsers (async WebCrypto).

Latest version **3.0.0** (published 2026-02-09) · MIT license · 0 weekly downloads

## Install

```sh
npm install password-generator
pnpm add password-generator
yarn add password-generator
bun add password-generator
```

Provides the command `password-generator`.

## Health

**Score 60/100 (C)** — status: stable.

Positive: has types; esm support; no vulnerabilities; high quality score.

Warnings: low downloads.

## Facts

| | |
|---|---|
| Version | 3.0.0 |
| Published | 2026-02-09 |
| First published | 2011-10-03 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | bundled |
| Module format | ESM + CommonJS |
| Node | >=20 |
| Dependencies | 0 |
| Unpacked size | 76.1 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 449 |
| Author | Bermi Ferrer <bermi@bermilabs.com> |
| Maintainers | bermi |
| Keywords | password, generator, pass, random, browser, crypto, security, webcrypto, esm |

## Links

- npm: https://www.npmjs.com/package/password-generator
- Repository: https://github.com/bermi/password-generator
- npm.io page: https://npm.io/package/password-generator

## Alternatives

- [@gemini-wallet/core](https://npm.io/package/@gemini-wallet/core.md) — 515.6K weekly downloads
- [utility](https://npm.io/package/utility.md) — 416.6K weekly downloads
- [@primno/dpapi](https://npm.io/package/@primno/dpapi.md) — 7.2K weekly downloads
- [pi-readseek](https://npm.io/package/pi-readseek.md) — 3.7K weekly downloads
- [@emilia-protocol/verify](https://npm.io/package/@emilia-protocol/verify.md) — 1.1K weekly downloads

## Recent versions

- 3.0.0 (latest) — 2026-02-09
- 2.3.2 — 2020-06-04
- 2.3.1 — 2020-06-02
- 2.3.0 — 2020-06-02
- 2.2.3 — 2019-11-01
- 2.2.2 — 2019-11-01
- 2.2.1 — 2019-11-01
- 2.2.0 — 2017-10-06
- 2.1.0 — 2016-12-15
- 2.0.6 — 2016-12-04
- 2.0.5 — 2016-12-04
- 2.0.2 — 2015-10-22
- 2.0.1 — 2015-09-25
- 2.0.0 — 2015-09-24
- 1.0.1 — 2015-08-24
- … 10 more at https://npm.io/package/password-generator/versions

## README

# Password Generator

Password generator with secure defaults, async WebCrypto randomness, and optional memorable mode for Node 20+ and modern browsers.

- ESM only, tree-shakeable
- Async API (Promise-based)
- Secure defaults (non-memorable)
- Bun build/test + Playwright browser checks

## Install

```bash
npm install password-generator
```

## CLI

```bash
password-generator -h
```

Examples:

```bash
password-generator
password-generator -l 30
password-generator -m
password-generator -s
password-generator -s4
password-generator -p "[\d\W\w]" -i
```

Notes:

- CLI defaults are length 16 for non-memorable passwords and length 20 for memorable passwords.
- `-s` generates 3 memorable words (3-7 letters) separated by spaces. `-sN` sets the word count.

## Usage (Node/Bun)

```ts
import { generatePassword } from "password-generator";

const pass = await generatePassword();
```

Memorable mode:

```ts
const pass = await generatePassword(20, true);
```

With options:

```ts
import { generatePasswordWithOptions } from "password-generator";

const pass = await generatePasswordWithOptions({
  length: 16,
  memorable: false,
  pattern: /\d/,
  prefix: "foo-",
  ignoreSecurityRecommendations: true,
});
```

Deterministic entropy for tests:

```ts
const pass = await generatePasswordWithOptions({
  length: 16,
  memorable: false,
  entropy: "seed",
});
```

Passphrase mode (memorable words, 3-7 letters each):

```ts
const passphrase = await generatePasswordWithOptions({
  words: 3,
});
```

`words` mode ignores `pattern` and does not support `prefix`.

## Usage (Browser)

```html
<script type="module">
  import { generatePassword } from "./dist/index.js";

  const pass = await generatePassword();
  console.log(pass);
</script>
```

## Security Recommendations

By default, the generator enforces a minimum estimated entropy of 64 bits. If your requested settings fall below this threshold, an error is thrown with a recommendation. To bypass the check (for testing or policy-driven constraints), pass `ignoreSecurityRecommendations: true`.

## API

```ts
export type GenerateOptions = {
  length?: number;
  memorable?: boolean;
  pattern?: RegExp;
  prefix?: string;
  ignoreSecurityRecommendations?: boolean;
  entropy?: Uint8Array | string;
  words?: number;
};

export async function generatePassword(
  length?: number,
  memorable?: boolean,
  pattern?: RegExp,
  prefix?: string,
): Promise<string>;

export async function generatePasswordWithOptions(
  options?: GenerateOptions,
): Promise<string>;
```

## Migration (v2 -> v3)

- `generatePassword()` is now async. Update your code to `await generatePassword()`.
- CommonJS `require()` is no longer supported. Use ESM `import` instead.
- Node 20+ is required.
- Defaults are now non-memorable with `length: 12`.
- Security recommendations enforce minimum entropy unless `ignoreSecurityRecommendations: true` is set.
- Legacy UMD/global builds and Bower/Ender integrations are removed.

## Development

```bash
bun install
bun run format
bun test --coverage
bun run build:all
bunx playwright install --with-deps chromium
bun run test:browser
bun run test:all
bun run ci:local
```

```bash
bun run publish
```

`ci:local` requires `act` installed locally.

## Benchmarks + Changelog

- `BENCHMARKS.md`
- `CHANGELOG.md`

## License

MIT

---
_Source: https://npm.io/package/password-generator · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._