GithubHelp home page GithubHelp logo

bermi / password-generator Goto Github PK

View Code? Open in Web Editor NEW
447.0 16.0 61.0 295 KB

Memorable password generator

Home Page: https://github.com/bermi/password-generator

License: MIT License

Makefile 7.85% JavaScript 92.15%

password-generator's Introduction

password-generator

Memorable password generator. For the command line, Node.js and browsers.

Build Status Dependency Status

Installation

$ npm install password-generator -g

Usage

From the CLI

password-generator -h

Displays this help

Generates a memorable password

Options:
  -l  Password length
  -c  Generates a non memorable password  [default: false]
  -p  Pattern to match for the generated password
  -h  Displays this help

Simple memorable pass

password-generator
=> maqetaxaku

Custom length

password-generator -l 30
=> nugiferagiraqadamedewubaqirali

Non memorable

password-generator -c
=> QPnb3gl7_0

Customize the pattern to match for each password character

password-generator -p "[\d\W\w\p]"
=> Je;VgG?{Yd

Any number or letter

password-generator -p "[\w]"
=> 3NHPqzjIAq

Combine multiple strategies 6 memorable and 3 numbers

echo "`password-generator -l 6``password-generator -p "[0-9]" -l 3`"
=> wazawe351

From Node.js

var generatePassword = require('password-generator');

From the browser

<script src="https://raw.github.com/bermi/password-generator/master/dist/password-generator.min.js" type="text/javascript"></script>

Browser support

Since v2.0.0 this library relies on cryptographic random values generated via crypto.getRandomValues. IE11 was the first IE version to include this method. Check caniuse.com for details.

Usage

Default settings (memorable 10 letters)

generatePassword() // -> xexeyimahi

Custom length not memorable

generatePassword(12, false) // -> 76PAGEaq6i5c

Characters should match a pattern

generatePassword(12, false, /\d/) // -> 252667390298

Customize the password prefix

generatePassword(12, false, /\d/, 'foo-') // -> foo-67390298

Example with custom validation rules

Given the pattern regexp can only match a single character you can build a function that generates multiple passwords until you hit one that complies with your rules.

The following example will generate a password with the following requirements

  • Must contain at least two numbers
  • Must contain at least three uppercase letters
  • Must contain at least three lowercase letters
  • Must contain at least two special characters
  • Must NOT contain sequences of two or more repeated characters
var generatePassword = require("password-generator");

var maxLength = 18;
var minLength = 12;
var uppercaseMinCount = 3;
var lowercaseMinCount = 3;
var numberMinCount = 2;
var specialMinCount = 2;
var UPPERCASE_RE = /([A-Z])/g;
var LOWERCASE_RE = /([a-z])/g;
var NUMBER_RE = /([\d])/g;
var SPECIAL_CHAR_RE = /([\?\-])/g;
var NON_REPEATING_CHAR_RE = /([\W\w\d\?\-])\1{2,}/g;

function isStrongEnough(password) {
  var uc = password.match(UPPERCASE_RE);
  var lc = password.match(LOWERCASE_RE);
  var n = password.match(NUMBER_RE);
  var sc = password.match(SPECIAL_CHAR_RE);
  var nr = password.match(NON_REPEATING_CHAR_RE);
  return password.length >= minLength &&
    !nr &&
    uc && uc.length >= uppercaseMinCount &&
    lc && lc.length >= lowercaseMinCount &&
    n && n.length >= numberMinCount &&
    sc && sc.length >= specialMinCount;
}

function customPassword() {
  var password = "";
  var randomLength = Math.floor(Math.random() * (maxLength - minLength)) + minLength;
  while (!isStrongEnough(password)) {
    password = generatePassword(randomLength, false, /[\w\d\?\-]/);
  }
  return password;
}

console.log(customPassword()); // => 2hP5v?1KJNx7_a-W

Running tests

npm install
make test

Building

npm install
make all

License

(The MIT License)

Copyright (c) 2011-2020 Bermi Ferrer <[email protected]>

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the 'Software'), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

password-generator's People

Contributors

bermi avatar chickahoona avatar edg2s avatar jlfwong avatar stevenvo avatar westy92 avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

password-generator's Issues

v2.3.x Do Not Handle Commandline Arguments

Since v2.3.0, it looks ignoring commandline arguments.

% node -v
v12.18.0
% npm -v
6.14.5
% sudo npm -g update
/usr/local/bin/password-generator -> /usr/local/lib/node_modules/password-generator/bin/password-generator
+ [email protected]
removed 3 packages and updated 1 package in 0.533s
% password-generator -h
gavufivoni
% sudo npm -g i [email protected]
/usr/local/bin/password-generator -> /usr/local/lib/node_modules/password-generator/bin/password-generator
+ [email protected]
updated 1 package in 0.278s
% password-generator -h
xuwenazejo

The latest valid ver. is v2.2.3:

% sudo npm -g i [email protected]
/usr/local/bin/password-generator -> /usr/local/lib/node_modules/password-generator/bin/password-generator
+ [email protected]
added 3 packages from 2 contributors and updated 1 package in 0.935s
% password-generator -h
Generates a memorable password

Options:
  -l: Password length                      [default: null]
  -c: Generates a non memorable password   [default: "memorable"]
  -p: Pattern to match for the generated password
  -h: Displays this help

Request: Add support for random seed

I want to create username's that conform to UTF-8 (chars only) based on emails. If I could plug in a seed for the random password generator then I could use your library to generate usernames based on email addresses.

Unable to generate a password with the tilde character

It is not possible to generate a password with a tilde (~) character in it. We get an error when this is executed:
generatePassword(12, false, /[\~]/)

The error lies in the loop bounds on Line 39 of /dist/password-generator.js:
for (i = 33; 126 > i; i += 1) {
The variable i will never reach ASCII 126 (the tilde character)

That line should be updated to:
for (i = 33; 126 >= i; i += 1) {
or the more normal representation:
for (i = 33; i <= 126; i += 1) {

(I saw that you just fixed issue #25 and released v2.2.2. Thank you! I wish I had caught this sooner so that it could have been rolled into that release.)

Multiple pattern checks

I'm having a rough time with a specific requirement for a pattern. I'm following the OWASP password strength requirements in a project & I'm trying to provide a randomly generated password using this package. However, trying to write a pattern to pass into this generator is proving very difficult.

My requirements:

  1. Must contain at least one number
  2. Must contain at least one uppercase letter
  3. Must contain at least one lowercase letter
  4. Must contain at least one special character
  5. Must NOT contain sequences of three or more repeated characters

Any advice on how to pass these requirements into generatePassword ?

One issue I keep having with this package, when I pass in a seemingly correctly formatted pattern, is the following message..

[Error: Could not find characters that match the password pattern /([A-Z]\w+)([a-z]\w+)([0-9]\w+)([\!\?]+)/. Patterns must match individual characters, not the password as a whole.]

This error makes sense to me, but the limitation of the generator doesn't. Shouldn't I be able to match against the "password as a whole"?

vulnerable dependency: yargs-parser

with https://www.npmjs.com/advisories/1500 coming up last night, could you please check to upgrade yargs-parser?

yarn audit v1.21.1
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ yargs-parser                                                 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=13.1.2 <14.0.0 || >=15.0.1 <16.0.0 || >=18.1.2             │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ password-generator                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ password-generator > yargs-parser                            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://www.npmjs.com/advisories/1500                        │
└───────────────┴──────────────────────────────────────────────────────────────┘

Hangs

For some reason the method hangs indefinitely when supplying these arguments for the third parameter:

/\d\W/
/\d\p/

I'm on Windows if it matters.

Generator never hits uppercase 'A'

I'm pretty sure that there is some kind of bug, that prevents capital A from appearing in passwords.
I've run this command: password-generator -c -l 50 -p "[a-zA-Z]" around 500 times and not a single 'A' appeared.

Here are some example results i ran into when I was examining this:

$ password-generator -c -l 50 -p "[Aa]"
> aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
$ password-generator -c -l 50 -p "[Aab]"
> baaabbbababababababababaaabbabababbababbabaabbaaab
$ password-generator -c -l 50 -p "[AaBb]"
> bBbBBBbBBbbabaaBbbbaabBBaBBaababBBBaBbbBaBaBabBbbB
$ password-generator -c -l 50 -p "[BAa]"
> aaBaaaaBBaaBaBBaBBBBBBBBaaBaaaBBaBBBBBaBBaBaBaaaBa

Moreover, it also affects other capital letters if they're only one in the pattern:

$ password-generator -c -l 50 -p "[aBb]"
> aaaabbaabaabbbbbbaaaabaabbbbbaaabbbbbababaabaabbab
$ password-generator -c -l 50 -p "[a-zC]"
> urjxuxmsjxpcfnssijcwwlxikgxgeqchuqeliwtyqjrnzbqxvt
$ password-generator -c -l 50 -p "[a-zAB]"
> tvkobyiyBztramssvestxsagbmzohboebshxBnxxdnlwtkiomh
$ password-generator -c -l 50 -p "[a-zABC]"
> wCfkzoxicsxomhshdibfvtpBiuraisbdyaootuBeavboaypxdc

Also, giving it one letter as pattern generates "Maximum call stack size exceeded" error.
All those generate this error:
password-generator -c -l 50 -p "[A]"
password-generator -c -l 50 -p "A"
password-generator -c -l 50 -p "[a]"
password-generator -c -l 50 -p "a"

But that may be working as intended, because of required at least 2 characters in the pattern for some randomness.


And a screenshot from console:

Screen from console

Uniqueness

How likely are generated passwords to be unique? Is there any mechanism in the algorithm used that can ensure uniqueness with high probability?

memorable option should not disable pattern

if memorable is enabled, you cannot get a password that matches the pattern. Always generates lower-cased letters.

generatePassword(10, true, /\d/);           // —> cuyupizuvo  (no numbers)
generatePassword(10, true, /[a-zA-Z]/);     // —> felunaturo  (could be FeluNAturo)
generatePassword(10, true, /[a-zA-Z\d]/);   // —> cimatugije  (could be C1matu9ije)

[Request] Add support for angular

I am not sure if this is possible , but would like to know if this can be used with Angular 6.

If yes can someone suggest me steps to use it cause i tried by creating a service and directly requiring this library but i ran into issues.

I also tried directly including this password-generator.min.js in angular.json file and accessing the function in my service that didn't work either typescript slaps a function not defined error!

If some one could help I would be really grateful. Thank you.

Old version in bower repo

When I try to install version 2.0.0 from bower I get error:

E:\work\personal\>bower install
bower password-generator#^2.0.0       not-cached git://github.com/bermi/password-generator.git#^2.0.0
bower password-generator#^2.0.0          resolve git://github.com/bermi/password-generator.git#^2.0.0
bower password-generator#^2.0.0     ENORESTARGET No tag found that was able to satisfy ^2.0.0

Additional error details:
Available versions: 1.0.1, 1.0.0, 0.2.4, 0.2.3, 0.2.2, 0.1.1, 0.1.0, 0.0.2

A cryptographically secure PRNG (crypto.getRandomValues) should be used instead of Math.random

It is critical that this library be updated to use a cryptographically secure pseudo-random number generator.

Math.random is not considered secure, while window.crypto.getRandomValues is:

http://stackoverflow.com/questions/5651789/is-math-random-cryptographically-secure
http://stackoverflow.com/questions/578700/how-trustworthy-is-javascripts-random-implementation-in-various-browsers
http://stackoverflow.com/questions/4083204/secure-random-numbers-in-javascript
https://dl.packetstormsecurity.net/papers/general/Google_Chrome_3.0_Beta_Math.random_vulnerability.pdf
https://dvcs.w3.org/hg/webcrypto-api/raw-file/tip/spec/Overview.html

Here's how to get random bytes with window.crypto.getRandomValues:

var array = new Uint8Array(32)
var randomBytes = window.crypto.getRandomValues(array)

algorithm behind

i would like to know if there is a known algorithm behind this password generation library. if there is one, which one?
thank you

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.