dsh-password

Generating a strong password sounds trivial, yet it hides real pitfalls: JavaScript Math.random is not cryptographically secure, and hand-rolled character-pool logic often misses constraints like requiring at least one lowercase, one uppercase, and one digit. dsh-password solves this by registering a password_generate tool in DSH whose randomness comes entirely from node:crypto.randomInt with uniform sampling, eliminating weak randomness at the source. The plugin is pure ESM, has zero dependencies, and requires no build step.

It offers two generation modes. The random mode lets you set a length between 8 and 128 characters, toggle a symbol set, and exclude ambiguous characters such as I, l, 1, O, and 0 by default. After each generation it verifies that at least one lowercase letter, one uppercase letter, and one digit are present, regenerating automatically up to 20 times before falling back to a deterministic complement as a safety net. The Diceware mode ships with a built-in list of 256 common English short words, each contributing 8 bits of entropy, and lets you configure the word count (4 to 8) and the separator, making it ideal for users who prefer memorable passphrases over random strings. Throughout the process passwords are produced and returned in memory only, never written to disk or logged, and the plugin holds no persistent state whatsoever.

It suits developers and operators who need quick one-off passwords within a DSH workflow, as well as security-conscious users who prefer Diceware passphrases and want cryptographically safe randomness without pulling in extra dependencies.