Passphrase Forge

A small, fully client-side passphrase generator. It strings together random words from the EFF Diceware long wordlist (7,776 words) and, optionally, sprinkles in random digits and symbols — producing passwords that are strong and readable.

Nothing is sent anywhere. All randomness comes from the browser's crypto.getRandomValues (a CSPRNG), and the app makes no network requests except loading its own code and font.

Why this approach

• Words, chosen randomly, beat character soup you can remember. A passphrase of 5–6 random words has enormous entropy while staying typeable.
• Entropy is measured honestly. The strength number is the entropy of the generation process (words × log₂(7776) plus any random digits/symbols), not a guess based on the final characters. Deterministic touches like capitalising the first letter add readability but zero entropy, and the app says so.
• No look-alike characters. The digit pool excludes 0 and 1 so they are never confused with O and l/I.

Run locally

npm install
npm run dev      # start the dev server (prints a local URL)
npm run build    # type-check + production build into dist/
npm run preview  # preview the production build

Requires Node 18+.

Deploy to GitHub Pages

Two options.

Option A — automatic (recommended)

This repo ships with .github/workflows/deploy.yml.

1. Create a repo on GitHub and push this project to the main branch.
2. In the repo, go to Settings → Pages → Build and deployment and set Source to GitHub Actions.
3. Every push to main builds the site and publishes it. Your URL will be https://<username>.github.io/<repo-name>/.

Option B — manual

npm run build

Then publish the generated dist/ folder however you like (e.g. push it to a gh-pages branch, or point Pages at a /docs copy).

vite.config.ts uses base: "./" (relative asset paths), so the build works at any sub-path — you don't need to hardcode your repo name.

Project structure

src/
├─ data/effWordlist.ts      the 7,776-word EFF list
├─ lib/
│  ├─ crypto.ts             CSPRNG helpers (unbiased random int, pick)
│  ├─ generate.ts           passphrase assembly + character pools
│  ├─ entropy.ts            entropy math + strength bands
│  ├─ format.ts             crack-time estimate + human-readable durations
│  └─ types.ts              shared types
├─ hooks/usePassphrase.ts   options + current passphrase state
├─ components/
│  ├─ Generator.tsx         orchestrates the three panels below
│  ├─ PassphraseDisplay.tsx the result, copy, and regenerate
│  ├─ StrengthMeter.tsx     crack time + entropy bar
│  ├─ Controls.tsx          word-count slider + toggles
│  └─ Toggle.tsx            reusable switch
├─ App.tsx                  page shell
└─ index.css                theme tokens + all styles

A note on the crack-time figure

The estimate assumes a fast offline attack at one trillion guesses/second — deliberately pessimistic. Against a properly slow password hash (bcrypt, Argon2), a real attacker is far slower, so anything that looks strong here is stronger in practice. The number is a teaching aid, not a guarantee.

License

The EFF wordlist is provided by the Electronic Frontier Foundation under CC-BY-3.0. Do whatever you like with the rest.