generate-password

generate-password is a small, dependency-free Node.js library for generating random and unique passwords. It draws its entropy from Node’s built-in crypto.randomBytes rather than Math.random, and rejects out-of-range byte values so that every character index is drawn uniformly from the chosen character pool instead of being subtly biased toward lower values.

The API exposes two functions: generate() for a single password and generateMultiple() for producing many passwords at once with the same options. Callers control the password length, which character pools to draw from (lowercase, uppercase, numbers, symbols, or a custom symbol string), whether to strip visually similar characters like ‘l’, ‘1’, ‘I’, and ‘O’, an explicit list of characters to exclude, and a strict mode that guarantees at least one character from every enabled pool by recursively regenerating the password until the constraint is satisfied.

What You Get

• A generate() function for producing a single password with configurable length and character pools
• A generateMultiple() function for bulk-generating many passwords with the same options in one call
• Cryptographically-secure randomness sourced from Node’s crypto.randomBytes with rejection sampling to avoid modulo bias
• A strict mode that guarantees at least one character from every enabled character class (lowercase, uppercase, numbers, symbols)
• Bundled TypeScript type definitions and named ESM exports alongside the CommonJS entry point

Common Use Cases

• Generating default passwords for newly created user accounts before the user sets their own
• Producing temporary one-time passwords for password-reset or invite-link flows
• Generating API keys, tokens, or random secrets for backend services
• Bulk-generating batches of unique passwords for test fixtures or seed data

Under The Hood

Architecture generate-password ships as a single ~150-line CommonJS module (src/generate.js) exposing two public functions, generate() and generateMultiple(), built on top of a private closured generate(options, pool) recursive helper and a batched random-byte reader (getNextRandomValue/randomNumber) that pulls fixed-size chunks from Node’s crypto.randomBytes and rejects out-of-range draws to avoid modulo bias. The public generate() function follows a straightforward pipeline: apply option defaults, assemble a character pool string from the enabled character classes (lowercase/uppercase/numbers/symbols), strip similar characters and any explicitly excluded characters, then build the password by repeatedly indexing into the pool with randomNumber(). When strict mode is set, the whole build is retried recursively until the output satisfies every enabled character-class rule, so there is no separate constraint-solving step, just retry-until-valid. generateMultiple() is a thin loop that calls generate() the requested number of times. There is no internal layering beyond this one file; the entire architecture is this pool-then-sample-then-validate flow.

Tech Stack The library has zero runtime dependencies, relying solely on Node’s built-in crypto module for randomness. It ships both a CommonJS entry point (main.js delegating to src/generate.js) and named-export support for ESM consumers via package.json’s exports map, plus a hand-authored src/generate.d.ts for TypeScript users. Development tooling is mocha and chai for tests, eslint (extending eslint:recommended with tab-indentation, single-quote, and semicolon rules) for linting, and jscover/codecov for coverage reporting, wired into a GitHub Actions workflow that runs the suite across multiple Node LTS versions.

Code Quality Tests live in test/generator.js, with behavioral assertions covering default generation, password length, strict-mode character-class guarantees, exclusion rules, and statistical duplicate-checking across large generated batches, plus test/esm.mjs, which verifies the named ESM exports resolve correctly. Error handling is explicit rather than silent: invalid configurations, such as strict-mode requirements that exceed the requested length, or every character pool disabled, throw descriptive TypeErrors instead of returning a malformed password. Naming and style are enforced by the linter; there is no static typing in the implementation itself, so the shipped .d.ts file is maintained by hand rather than derived from the source, and CI runs lint, test, and coverage on every push.

API Design The public surface is deliberately tiny: generate([options]) and generateMultiple(amount, [options]), both usable with zero configuration thanks to sensible defaults (10 characters, upper and lowercase enabled, numbers and symbols off). Options form a flat, clearly named object (length, numbers, symbols, uppercase, lowercase, excludeSimilarCharacters, exclude, strict) documented in a single README table, and symbols can be either a boolean or a custom string of allowed symbol characters. TypeScript types and named ESM exports are both provided out of the box, so consumers get autocomplete and can import { generate } directly without touching require(). Documentation beyond the README table is minimal, with no dedicated docs site, but the API itself requires no boilerplate to start using.