lockly

Cryptographically secure password generator CLI.

Generates unpredictable random passwords instantly using the Web Crypto API (crypto.getRandomValues()).

Features

• Cryptographically secure — CSPRNG via Web Crypto API
• Browser compatible — works in Node.js and browsers
• Fast — under 50ms response time
• Customizable — length, character sets, count, charset inclusion guarantee (--ensure)
• Pipe-friendly — clean stdout output, no ANSI colors
• Zero install — run instantly with npx

Install

# Run instantly with npx (recommended)
npx lockly

# Or install globally
npm install -g lockly

Usage

Basic

# Default: generate a 16-character password
lockly

# Set length (32 characters)
lockly -l 32
lockly --length 32

# Generate multiple passwords (5)
lockly -c 5
lockly --count 5

Character set filtering

# Exclude symbols
lockly --no-symbols

# Digits only (PIN)
lockly --no-uppercase --no-lowercase --no-symbols -l 6

# Uppercase and digits only
lockly --no-lowercase --no-symbols

Ensure charset inclusion

# Guarantee at least one character from each active charset
lockly --ensure

# Short password with guaranteed diversity
lockly --ensure -l 4

Piping

# Copy to clipboard (macOS)
lockly | pbcopy

# Copy to clipboard (Linux)
lockly | xclip -selection clipboard

# Copy to clipboard (Windows PowerShell)
lockly | Set-Clipboard

# Save to file
lockly -c 10 -l 32 > passwords.txt

# Set as environment variable
export DB_PASSWORD=$(lockly -l 24 --no-symbols)

Options

Option	Description	Default	Range
-l, --length <number>	Password length	16	1–1024
-c, --count <number>	Number of passwords	1	1+
--no-uppercase	Exclude uppercase (A-Z)	included	-
--no-lowercase	Exclude lowercase (a-z)	included	-
--no-numbers	Exclude digits (0-9)	included	-
--no-symbols	Exclude symbols	included	-
--ensure	Guarantee at least one char from each active charset	off	-
-V, --version	Show version	-	-
-h, --help	Show help	-	-

Security

• CSPRNG: Uses crypto.getRandomValues() (Web Crypto API) instead of Math.random()
• Local execution: No network requests — passwords are generated locally
• Stateless: Generated passwords are never stored
• No modulo bias: Rejection sampling ensures uniform distribution

Security tips

• Store generated passwords immediately in a secure location (e.g. password manager)
• Use piping to avoid passwords appearing in terminal history
• Use -l 32 or longer for high-security purposes (root accounts, financial services, etc.)

Programmatic API

Use lockly as a library in your TypeScript/JavaScript project.

import { generatePassword } from 'lockly';

// Default usage
const passwords = generatePassword();
console.log(passwords[0]); // 16-character password

// With options
const customPasswords = generatePassword({
  length: 32,
  count: 5,
  uppercase: true,
  lowercase: true,
  numbers: true,
  symbols: false
});

// Ensure at least one character from each active charset
const ensured = generatePassword({
  length: 16,
  ensure: true
});

Requirements

• Node.js 20+ or any modern browser with Web Crypto API support

License

MIT