pwgen

Cryptographically random password / passphrase / PIN / WiFi generator

v1.0.0
NixOS x86_64

Quick start

Install via jcli (recommended)

jcli install pwgen

If you don't have jcli yet, install it first with curl -fsSL https://cli.johlem.net/tools/jcli/install.sh | bash.

Install directly

curl -fsSL https://cli.johlem.net/install.sh | bash -s -- pwgen

Ed25519 signature verification is mandatory by default; set ALLOW_UNVERIFIED=1 to explicitly opt out (not recommended).

Run it

pwgen --help                # subcommand catalogue + flags
pwgen --full                # extended help across every subcommand
pwgen --about               # machine-readable attribution (JSON)
pwgen --version             # version string

What it does

pwgen is the small, predictable password / passphrase / PIN generator that composes with the rest of the cli.johlem.net suite. Four subcommands: gen (24-char mixed-class default, `--no-upper / --no-digits / --no-symbols / --no-ambiguous` knobs), phrase (6-word diceware-style with embedded 256-word list, `--separator`), pin (6-digit numeric default), wifi (63-char WPA2-PSK ready). All generators pull randomness from rand::rngs::OsRng (the OS CSPRNG) — no thread_rng fallback. Suite app: opsec. Pure stdout; no state, no network. 5 unit + 12 integration tests; zero warnings. The "1 day" of the 2026-06-23 productivity queue.

Authorisation and warranty: use only in environments where you have explicit written authorisation. This tool is provided as-is with no warranty. Report vulnerabilities privately at security@johlem.net.

Release artefacts & provenance

Every signed release ships with checksum + signature sidecars plus a CycloneDX SBOM. Enterprise procurement can pin third-party components without unpacking the binary.