Research
Security News
Kill Switch Hidden in npm Packages Typosquatting Chalk and Chokidar
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
generate-passphrase-id
Advanced tools
Zero dependency module - Secure random passphrase in Indonesian language
✨Zero dependency module for generating passphrase.
An Indonesian language fork of (also my repository) generate-passphrase.
The code is close to node generate-password repo. But this is for a passphrase, with Indonesian language.
ProtonMail has a decent article explaining about password vs passphrase.
Is this secure? Yes. I don't use Math.floor
, I used the crypto
module.
Why is this repo heavy? I'm using scraped words list from KBBI for fetching the Indonesian word list. If you have a better idea/workaround for this, feel free to open up an issue and file a PR! I'll gladly accept any feedbacks.
$ npm install generate-passphrase-id
# or
$ yarn add generate-passphrase-id
# or basically any package manager you like.
import { generate, generateMultiple } from 'generate-passphrase-id'
// or
const { generate, generateMultiple } = require('generate-passphrase-id')
const passphrase = generate();
// 'spionase-syahwat-41-neolitikum'
const anotherPassphrase = generate({ length: 3, separator: '.', titlecase: true })
// see available options below
const multiplePassphrase = generateMultiple(3)
// ['pomologi-jerojol-kalau-senandika', 'kakek-meristem-89-emigras', ... ]
const anotherMultiplePassphrase = generateMultiple(10, { length: 2, uppercase: true, numbers: false })
I know some of us need to generate it fast just for the sake of it, you can add fast
as a parameter. (It defaults to false). Please bear in mind, this would make the returning random passphrase not cryptographically secure
const fast = generate({ fast: true })
// cultivars-strigose-avisements-58
const extraFast = generateMultiple(5, { fast: true })
// ['extrorsal-169-resultlessness-168', 'postmodern-kolkhozniki-skulkers-99', ... ]
Key | Type | Default |
---|---|---|
length | integer | 4 |
separator | string | '-' |
numbers | boolean | true |
uppercase | boolean | false |
titlecase | boolean | false |
pattern | string | null |
A few things to note:
true
, it will be words full of uppercase.TL;DR: It's slow.
I'm using:
Benchmark for single passphrase/password:
Module | Ops/sec | Accuracy | Runs sampled |
---|---|---|---|
generate-passphrase-id | 107,649 | ±1.89% | 407 |
generate-passphrase (fast enabled) | 503,082 | ±1.26% | 438 |
generate-password | 401,664 | ±1.33% | 335 |
niceware | 268,618 | ±1.95% | 319 |
randomatic | 7,870 | ±3.16% | 307 |
Benchmark for multiple passphrase/password (generateMultiple
function):
Module | Ops/sec | Accuracy | Runs sampled |
---|---|---|---|
generate-passphrase-id | 11,714 | ±1.37% | 425 |
generate-passphrase-id (fast enabled) | 50,090 | ±2.54% | 432 |
generate-password | 40,261 | ±2.26% | 332 |
Yes please.
FAQs
Zero dependency module - Secure random passphrase in Indonesian language
We found that generate-passphrase-id demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.